{
  "id": "playbook--malware-detected",
  "name": "Malware Detection Response",
  "version": "1.0",
  "mitre": "TA0003/T1053",
  "trigger": {
    "event_type": "malicious_process_or_file",
    "severity": ["high", "critical"]
  },
  "steps": [
    {
      "id": "step-1",
      "name": "Collect evidence",
      "action": "exec",
      "command": "ps auxf | grep $$malicious_pid$$; ls -la $$malicious_path$$; md5sum $$malicious_path$$"
    },
    {
      "id": "step-2",
      "name": "Contain threat",
      "action": "exec",
      "command": "sudo kill -9 $$malicious_pid$$; sudo mv $$malicious_path$$ /tmp/quarantine/",
      "depends_on": "step-1"
    },
    {
      "id": "step-3",
      "name": "Generate report",
      "action": "write",
      "template": "incident_report",
      "depends_on": "step-2"
    }
  ]
}