[
  {
    "gold_verdict": "malicious",
    "gold_decision": "escalate",
    "predicted_report": {
      "verdict": "malicious",
      "decision": "escalate",
      "confidence": 0.9,
      "techniques": [
        "T1566.001",
        "T1204.002",
        "T1059.001",
        "T1105"
      ],
      "summary": "PowerShell encoding obscured a malicious payload delivered via an external email attachment. Script block and module logs should be preserved, and fleet-wide logging policy reviewed.",
      "evidence_ids": [
        "EV-0010",
        "EV-0011",
        "EV-0012"
      ],
      "recommended_actions": [
        "Preserve script block and module logs (Event 4104)",
        "Contain host if payload execution is confirmed",
        "Hunt fleet-wide for identical command-line artifacts"
      ]
    }
  },
  {
    "gold_verdict": "malicious",
    "gold_decision": "escalate",
    "predicted_report": {
      "verdict": "malicious",
      "decision": "escalate",
      "confidence": 0.9,
      "techniques": [
        "T1021.002"
      ],
      "summary": "ADMIN$ share lateral movement followed by remote service creation \u2014 classic PsExec-style propagation. All critical targets are accounted for and quarantined.",
      "evidence_ids": [
        "EV-0005",
        "EV-0006",
        "EV-0007",
        "EV-0008"
      ],
      "recommended_actions": [
        "Map all ADMIN$/C$ connections sourced from the origin host",
        "Identify the credential used; reset and block it",
        "Remove remotely created services and dropped binaries",
        "Review local admin group membership on touched hosts"
      ]
    }
  },
  {
    "gold_verdict": "malicious",
    "gold_decision": "escalate",
    "predicted_report": {
      "verdict": "malicious",
      "decision": "escalate",
      "confidence": 0.9,
      "techniques": [
        "T1021.002"
      ],
      "summary": "ADMIN$ share lateral movement pattern matches PsExec-style remote service creation; service removal and credential reset are critical next steps.",
      "evidence_ids": [
        "EV-0005",
        "EV-0006",
        "EV-0007",
        "EV-0008"
      ],
      "recommended_actions": [
        "Map all ADMIN$/C$ connections sourced from WKS-052",
        "Identify the credential used; reset and block it",
        "Remove remotely created services and dropped binaries",
        "Review local admin group membership on touched hosts"
      ]
    }
  },
  {
    "gold_verdict": "malicious",
    "gold_decision": "escalate",
    "predicted_report": {
      "verdict": "malicious",
      "decision": "escalate",
      "confidence": 0.9,
      "techniques": [
        "T1558.003"
      ],
      "summary": "Kerberoasting pattern: burst of RC4 TGS requests for service accounts by henry.patel. Service account passwords should be rotated.",
      "evidence_ids": [
        "EV-0004",
        "EV-0005",
        "EV-0006"
      ],
      "recommended_actions": [
        "Reset affected service account passwords (gMSA where possible)",
        "Review henry.patel activity for compromise",
        "Enforce AES for service tickets"
      ]
    }
  },
  {
    "gold_verdict": "benign",
    "gold_decision": "close",
    "predicted_report": {
      "verdict": "benign",
      "decision": "close",
      "confidence": 0.8,
      "techniques": [],
      "summary": "Benign: service 'monitoring-agent' matches a documented change ticket; binary is signed and under Program Files.",
      "evidence_ids": [
        "EV-0004"
      ],
      "recommended_actions": [
        "Close with change-ticket reference"
      ]
    }
  }
]