{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"203.0.113.45","is_critical":true,"osint_result":{"source":"AbuseIPDB","verdict":"malicious","details":"IP reported 947 times for various malware attacks"}},{"id":"artifact_2","type":"command","value":"powershell -NoProfile -ExecutionPolicy Bypass -Command $payload = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aGVsbG8gd29ybGQ=')); iex $payload","is_critical":true,"osint_result":{"source":"Hybrid Analysis","verdict":"malicious","details":"Command associated with fileless malware payloads"}},{"id":"artifact_3","type":"hash","value":"e99a18c428cb38d5f260853678922e03","is_critical":true,"osint_result":{"source":"VirusTotal","verdict":"malicious","details":"Hash linked to known malicious PowerShell scripts"}}],"expected_actions":["isolate_host","block_ip","collect_forensics"],"expected_verdict":"true_positive","expected_category":"malware","analysis_notes":"The use of PowerShell with encoded commands and known malicious hash indicates a sophisticated fileless malware attack."}