{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"198.51.100.47","is_critical":true,"osint_result":{"source":"Hybrid Analysis","verdict":"malicious","details":"Associated with Lazarus Group C2 infrastructure"}},{"id":"artifact_2","type":"command","value":"powershell -enc WwBTAFkAUwB0AGUAbQAuAE4AZQBUAC4AVwBlAGIAQwBsAGkAZQBuAHQAXQAuAEQAbwB3AG4AbABvAGEAZABTAHIAdABhAG0AIAA=","is_critical":true,"osint_result":{"source":"Pattern Analysis","verdict":"malicious","details":"Detected obfuscation technique used by APT actors"}},{"id":"artifact_3","type":"hash","value":"4c2f5e0b9a3b4f1f8c37a3f9f2a4b1d0","is_critical":true,"osint_result":{"source":"VirusTotal","verdict":"suspicious","details":"Hash seen in recent fileless malware campaigns"}}],"expected_actions":["isolate_host","block_ip","collect_forensics"],"expected_verdict":"true_positive","expected_category":"malware","analysis_notes":"The use of PowerShell obfuscation and the link to a known Lazarus C2 server confirms this as a true positive."}