Cortex XDR - CVE-2025-49704 and CVE-2025-49706 and CVE-2025-53770 and CVE-2025-53771 - Microsoft SharePoint ToolShell vulnerability chain

id: Cortex XDR - CVE-2025-49704 and CVE-2025-49706 and CVE-2025-53770 and CVE-2025-53771 - Microsoft SharePoint ToolShell vulnerability chain
version: -1
name: Cortex XDR - CVE-2025-49704 and CVE-2025-49706 and CVE-2025-53770 and CVE-2025-53771 - Microsoft SharePoint ToolShell vulnerability chain
description: "This playbook should be triggered manually or can be configured as a job.\n\nCVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 are a set of vulnerabilities that impact Microsoft SharePoint. CVE-2025-49704 and CVE-2025-49706, or CVE-2025-53770 and CVE-2025-53771, may be chained together, allowing unauthenticated threat actors to access functionality that is normally restricted, to run arbitrary commands on vulnerable instances of Microsoft SharePoint.\n\n### Vulnerability Overview\n\n* **Platform Affected**: Microsoft SharePoint Server 2016 / 2019 / Subscription Edition\n* **CVE IDs**:\n  * CVE-2025-49706 – Improper authentication in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.\t\n  * CVE-2025-49704 – Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n  * CVE-2025-53770 – Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.\t\n  * CVE-2025-53771 – Improper limitation of a pathname to a restricted directory (path traversal) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.\t\n\n* **CVSS Scores**: 7.1, 8.8, 9.8 ,7.1\n\n* **Impact**:When chained together, they allow an attacker to run arbitrary commands on vulnerable instances of Microsoft SharePoint.\n\nThese flaws enable an attacker to:\n- Spoof authentication\n- Bypass security boundaries\n- Gain remote execution\n\n\n### Mitigation & Recommendations\n\n* Apply Patches Immediately:\n  * [CVE-2025-49706](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706)\n  * [CVE-2025-49704](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704)\n  * [CVE-2025-53770](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770)\n  * [CVE-2025-53771](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771)\n\n* Harden SharePoint diagnostic/debug endpoints\n* Rotate SharePoint Server ASP.NET machine keys\n* Check IIS logs for suspicious activity\n* Disable/Isolate unnecessary SharePoint services or endpoints (at least until those servers are patched)\n\n---\n\n### References\n\n* [CVE-2025-49706 - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-49706)\n* [CVE-2025-49704 - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-49704)\n* [CVE-2025-53770 - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-53770)\n* [CVE-2025-53771 - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-53771)\n* [Microsoft Security Update – July 2025](https://msrc.microsoft.com/update-guide/)\n* [Unit42 Blog](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/)\n\n---\n\n### How to trigger the playbook\n\nTriggered via:\n- Cortex XDR alerts: `\"CVE Exploitation - 685768089\"` or `\"CVE Exploitation - 818854253\"` or `\"CVE Exploitation - 903162508\"`\n- Manual creation of an alert with this playbook.\n\n---\n\n### Playbook Flow\n\n1. Run XQL Queries to detect possible affected servers running Microsoft SharePoint.\n2. Search for downloaded or created webshell files using XQL (especially for the known file name artifacts).\n3. Run XQL on network events and XDR .net events to determine if there was any usage of the CVEs in the organization.\n4. Check for malicious activity on the possible affected hosts for post-exploitation activities (such as running PowerShell encoded commands on the hosts) via additional alerts on the same host.\n5. Retrieve  IOCs from the Unit42 blog, hunt for those IOCs with XQL, and block malicious indicators.\n6. Instruct the analyst on relevant response actions and mitigation steps.\n\n---\n\n**Note:** \nThis is a beta playbook. Updates to the pack during the beta phase might include non-backward-compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.\n"
tags:
- Rapid Breach Response
- CVE-2025-49704
- CVE-2025-49706
- CVE-2025-53771
- CVE-2025-53770
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: b2af7ad6-9517-45cc-8d51-84e3b20db568
    type: start
    task:
      id: b2af7ad6-9517-45cc-8d51-84e3b20db568
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 338e745f-d7b8-4e5f-8a85-2f3756528d4c
    type: regular
    task:
      id: 338e745f-d7b8-4e5f-8a85-2f3756528d4c
      version: -1
      name: XQL Query - Search for any SharePoint servers that might be vulnerable
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "2"
      '#none#':
      - "4"
    scriptarguments:
      extend-context:
        simple: PossibleSPServers=
      ignore-outputs:
        simple: "true"
      max_fields:
        simple: "100"
      query:
        simple: "config timeframe = 7d case_sensitive = false \n| dataset = xdr_data \n| filter event_type = ENUM.LOAD_IMAGE and event_sub_type = ENUM.LOAD_IMAGE_MODULE and (action_file_path contains \"Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\" or actor_process_image_path contains \"Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\" or causality_actor_process_image_path contains \"Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\" or event_thread_context contains \"Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\")\n| fields agent_id\n| dedup agent_id"
      query_name:
        simple: Search for any SharePoint servers that might be vulnerable
      time_frame:
        simple: 1 week ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: b33e1ad4-3335-45c7-8013-0f73e10fea3e
    type: regular
    task:
      id: b33e1ad4-3335-45c7-8013-0f73e10fea3e
      version: -1
      name: Manual – Search possible hosts
      description: "Dear Analyst,\n\nEnsure that the 'XQL Query Engine' integration is active. If it's not enabled, activate the integration or manually run the following XQL query to determine if any hosts are running a potentially vulnerable product.\n\nXQL Query:\n\n```config timeframe = 7d case_sensitive = false \ndataset = xdr_data \n| filter event_type = ENUM.LOAD_IMAGE and event_sub_type = ENUM.LOAD_IMAGE_MODULE and (action_file_path contains \"Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\" or actor_process_image_path contains \"Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\" or causality_actor_process_image_path contains \"Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\" or event_thread_context contains \"Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\")\n| fields agent_id\n| dedup agent_id ```\n\n-------\n\nOptional check using Beta PowerShell script ( on dedicated machines ):\n\n``` function Get-SharePointVulnStatus {\n    $farmVersion = (Get-SPFarm).BuildVersion\n    Write-Output \"Detected SharePoint Build: $farmVersion\"\n\n    if (($farmVersion.Major -eq 16) -and ($farmVersion.Minor -eq 0)) {\n        $build = $farmVersion.Build\n        $revision = $farmVersion.Revision\n\n        if (\n            ($build -lt 5508) -or\n            ($build -eq 5508 -and $revision -lt 1000)\n        ) {\n            Write-Output \"❌ SharePoint 2016 is vulnerable to CVE-2025-49704/49706\"\n        }\n        elseif (\n            ($build -lt 10417) -or\n            ($build -eq 10417 -and $revision -lt 20027)\n        ) {\n            Write-Output \"❌ SharePoint 2019 is vulnerable to CVE-2025-49704/49706\"\n        }\n        elseif ($build -lt 18526) {\n            Write-Output \"❌ SharePoint SE may be vulnerable (check July 2025 patch level)\"\n        }\n        else {\n            Write-Output \"✅ SharePoint appears patched\"\n        }\n    } else {\n        Write-Output \"⚠️ Unknown SharePoint version or product\"\n    }\n}\nGet-SharePointVulnStatus ```"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "103"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1210,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: ddbaf3fd-9e95-408a-b6d9-567d8461cf88
    type: condition
    task:
      id: ddbaf3fd-9e95-408a-b6d9-567d8461cf88
      version: -1
      name: Is the integration of 'XQL Query Engine' available?
      description: Returns 'yes' if integration brand 'XQL Query Engine' is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "2"
      "yes":
      - "5"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 9aad6499-a1a6-42e1-83a6-cc943fa03c98
    type: condition
    task:
      id: 9aad6499-a1a6-42e1-83a6-cc943fa03c98
      version: -1
      name: Any results from XQL?
      description: Any results from the XQL Query?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "92"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: PossibleSPServers.results.agent_id
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d18c4944-e521-4def-838f-57aadbe31163
    type: regular
    task:
      id: d18c4944-e521-4def-838f-57aadbe31163
      version: -1
      name: Check XQL Quota
      description: Retrieve the amount of query quota available and used.
      script: '|||xdr-xql-get-quota'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 6548530d-9500-4880-8211-08f0588a65a3
    type: condition
    task:
      id: 6548530d-9500-4880-8211-08f0588a65a3
      version: -1
      name: Is there enough quota?
      description: Check if there is enough quota to run the query.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: PaloAltoNetworksXQL.Quota
                accessor: license_quota
                transformers:
                - operator: subtraction
                  args:
                    by:
                      value:
                        simple: PaloAltoNetworksXQL.Quota.used_quota
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: "1"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 4eabaa38-15d0-4767-8cd2-8376744ea32c
    type: title
    task:
      id: 4eabaa38-15d0-4767-8cd2-8376744ea32c
      version: -1
      name: 'XQL: Identify SharePoint Instances'
      description: This section identifies Microsoft SharePoint instances.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 85ce6905-1526-4f6f-8ce0-23b8405e8603
    type: title
    task:
      id: 85ce6905-1526-4f6f-8ce0-23b8405e8603
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1667.5,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 5b5fd783-75a9-4d0e-8255-d9584b2d2524
    type: title
    task:
      id: 5b5fd783-75a9-4d0e-8255-d9584b2d2524
      version: -1
      name: Hunt For IOCs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 2097.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 708b7d84-97f2-44d7-86e9-86f8a160a77e
    type: title
    task:
      id: 708b7d84-97f2-44d7-86e9-86f8a160a77e
      version: -1
      name: Anlysis Endpoints
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "133"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2422.5,
          "y": 1745
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: e44cca53-a7d6-483d-8a72-c1ba855cc223
    type: title
    task:
      id: e44cca53-a7d6-483d-8a72-c1ba855cc223
      version: -1
      name: Collect Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "124"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 2265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 9827a18d-207d-4c47-89da-a75a26edf02e
    type: regular
    task:
      id: 9827a18d-207d-4c47-89da-a75a26edf02e
      version: -1
      name: Extract indicators from collected data
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      text:
        complex:
          root: http.parsedBlog
          accessor: indicators
          transformers:
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 2775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 8dbf70ad-a682-4dc8-8e4a-4ca32f59b45b
    type: title
    task:
      id: 8dbf70ad-a682-4dc8-8e4a-4ca32f59b45b
      version: -1
      name: Tag and Link Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
      - "24"
      - "51"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 2957.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: adb46886-01ce-4ac7-86b5-54d58ec82508
    type: regular
    task:
      id: adb46886-01ce-4ac7-86b5-54d58ec82508
      version: -1
      name: Tag IP Indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      retry-count:
        simple: "3"
      retry-interval:
        simple: "2"
      tags:
        simple: CVE-2025-49704,CVE-2025-49706,CVE-2025-53770,CVE-2025-53771
      type:
        simple: IP
      value:
        complex:
          root: ExtractedIndicators.IP
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.IP
                iscontext: true
          transformers:
          - operator: uniq
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 150,
          "y": 3130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 3f088dc0-c557-4bc5-850b-3a7c246d7c92
    type: regular
    task:
      id: 3f088dc0-c557-4bc5-850b-3a7c246d7c92
      version: -1
      name: Tag CVE Indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      retry-count:
        simple: "3"
      retry-interval:
        simple: "2"
      tags:
        simple: Microsoft SharePoint ToolShell vulnerability chain
      type:
        simple: CVE
      value:
        complex:
          root: ExtractedIndicators
          accessor: CVE
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 3130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: ccdc1ca0-6c04-47f9-8bed-40d78d4ee5ea
    type: title
    task:
      id: ccdc1ca0-6c04-47f9-8bed-40d78d4ee5ea
      version: -1
      name: Extract Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 2607.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: cfc1edac-5845-4905-8824-66aae5d1c770
    type: title
    task:
      id: cfc1edac-5845-4905-8824-66aae5d1c770
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "93"
      - "140"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 4685
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: ab0e2879-907b-4082-8987-499a62cd18df
    type: title
    task:
      id: ab0e2879-907b-4082-8987-499a62cd18df
      version: -1
      name: Mitigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "99"
      - "87"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 5185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 814826d7-c289-46d2-8a65-f026ce383925
    type: condition
    task:
      id: 814826d7-c289-46d2-8a65-f026ce383925
      version: -1
      name: Analysis Resolution - Should continue with the investigation?
      description: |+
        ## Check with the analyst to determine whether to continue the investigation.

        - Verify that Microsoft SharePoint is on the affected servers and the patches are implemented.

        - Check if the Threat Hunting steps returned results (if any).

        - Validate that there are no other affected systems, and the Potential WebShells are investigated.


      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "37"
      "Yes":
      - "36"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 5815
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Do you need to continue with the investigation?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: cb07a02c-6974-42bc-820c-686b39019e39
    type: title
    task:
      id: cb07a02c-6974-42bc-820c-686b39019e39
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 6185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 958255be-55b9-4867-8a71-8f8e821fe95a
    type: regular
    task:
      id: 958255be-55b9-4867-8a71-8f8e821fe95a
      version: -1
      name: Investigate Further
      description: |
        ## Manual step for further alert investigation.

        - Keep monitoring IOCs for suspicious actions.
        - Check if there are any other suspicious artifacts created with the investigated webshell and continue your investigation on them.
        - Keep monitoring for new [hot-fixes and KBs released by Microsoft](https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/) related to these CVEs.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1447.5,
          "y": 6010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 831d958a-0829-4335-8098-e2cef5d79234
    type: regular
    task:
      id: 831d958a-0829-4335-8098-e2cef5d79234
      version: -1
      name: Close Investigation
      description: Close the current alert
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      closeReason:
        simple: No further actions are required.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 6010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: a9d516e8-adcb-4594-809d-a74d66596738
    type: title
    task:
      id: a9d516e8-adcb-4594-809d-a74d66596738
      version: -1
      name: Resolution
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 5685
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: f45d25c1-0fe6-4fa8-b755-2dda97a339ef
    type: regular
    task:
      id: f45d25c1-0fe6-4fa8-b755-2dda97a339ef
      version: -1
      name: Link Indicators to Alert
      description: commands.local.cmd.associate.indicators
      script: Builtin|||associateIndicatorsToIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      incidentId:
        simple: ${incident.id}
      indicatorsValues:
        complex:
          root: ExtractedIndicators.IP
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.IP
                iscontext: true
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.URL
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.CVE
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 3330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: ee812c22-0493-4d3f-8c3f-2554c363cf7d
    type: regular
    task:
      id: ee812c22-0493-4d3f-8c3f-2554c363cf7d
      version: -1
      name: Tag File Indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      retry-count:
        simple: "3"
      retry-interval:
        simple: "2"
      tags:
        simple: CVE-2025-49704,CVE-2025-49706,CVE-2025-53770,CVE-2025-53771
      type:
        simple: File
      value:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
          transformers:
          - operator: uniq
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 3130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "68":
    id: "68"
    taskid: 1a842e2a-8096-4fb1-85ea-7b79709a118e
    type: title
    task:
      id: 1a842e2a-8096-4fb1-85ea-7b79709a118e
      version: -1
      name: Threat Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "109"
      - "138"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 3485
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "72":
    id: "72"
    taskid: 029aebfe-e96a-422d-86c9-9c32548c40f6
    type: condition
    task:
      id: 029aebfe-e96a-422d-86c9-9c32548c40f6
      version: -1
      name: Are there any SharePoint hosts?
      description: This task checks if any SharePoint hosts are found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "73"
      - "114"
      - "125"
      - "134"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: agentsidstocheck
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2422.5,
          "y": 2082.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "73":
    id: "73"
    taskid: 0357ac26-ba2f-4166-822c-a92514b61332
    type: title
    task:
      id: 0357ac26-ba2f-4166-822c-a92514b61332
      version: -1
      name: Web Shell XQL Hunt
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "75"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 2265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: 0cdcffaf-e0de-4d8b-8e6e-e5a55fc87503
    type: regular
    task:
      id: 0cdcffaf-e0de-4d8b-8e6e-e5a55fc87503
      version: -1
      name: XQL Query - Search possible web shells
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "79"
      '#none#':
      - "94"
    scriptarguments:
      extend-context:
        simple: XQLPossibleMaliciousFiles=
      ignore-outputs:
        simple: "true"
      max_fields:
        simple: "100"
      query:
        simple: |-
          config case_sensitive = false timeframe=7d
          | dataset = xdr_data
          | filter agent_id in (${agentsidstocheck})
          | filter event_type = ENUM.FILE and event_sub_type in (ENUM.FILE_WRITE, ENUM.FILE_CREATE_NEW)
          | filter action_file_path contains "program files\common files\microsoft shared\web server extensions\*\template\layouts\"
          | alter is_known_exploit = if(action_file_path contains "spinstall0.aspx" or action_file_path contains "debug_dev.js" , "Yes" , "Unknown file")
          | fields agent_id,agent_hostname,action_file_path,is_known_exploit
          | dedup action_file_path
      query_name:
        simple: Check for possibles malicious payload
      time_frame:
        simple: 7 days ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 3125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "75":
    id: "75"
    taskid: 845bf422-797d-47ac-893b-630cf5c58273
    type: condition
    task:
      id: 845bf422-797d-47ac-893b-630cf5c58273
      version: -1
      name: Is the integration of 'XQL Query Engine' available?
      description: Returns 'yes' if integration brand 'XQL Query Engine' is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "79"
      "yes":
      - "77"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1667.5,
          "y": 2600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "77":
    id: "77"
    taskid: c48630f3-7585-4e9b-893e-196203697f94
    type: regular
    task:
      id: c48630f3-7585-4e9b-893e-196203697f94
      version: -1
      name: Check XQL Quota
      description: Retrieve the amount of query quota available and used.
      script: '|||xdr-xql-get-quota'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "78"
    scriptarguments:
      extend-context:
        simple: PaloAltoNetworksXQL.Quota2=
      ignore-outputs:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1697.5,
          "y": 2775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "78":
    id: "78"
    taskid: cdbbc295-3e51-4a9f-83be-8945c1a5140e
    type: condition
    task:
      id: cdbbc295-3e51-4a9f-83be-8945c1a5140e
      version: -1
      name: Is there enough quota?
      description: Is there enough quota?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "79"
      "yes":
      - "74"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: PaloAltoNetworksXQL.Quota2
                accessor: license_quota
                transformers:
                - operator: LastArrayElement
                - operator: subtraction
                  args:
                    by:
                      value:
                        simple: PaloAltoNetworksXQL.Quota2.used_quota
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: "1"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1697.5,
          "y": 2950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "79":
    id: "79"
    taskid: 185c3cc0-546c-425c-8fbc-b2e617aa8ff3
    type: regular
    task:
      id: 185c3cc0-546c-425c-8fbc-b2e617aa8ff3
      version: -1
      name: Manual – Search web shells using XQL query and quarantine the files
      description: |-
        Dear Analyst,

        Ensure that the 'XQL Query Engine' integration is active. If it's not enabled, activate the integration or manually run the following XQL query to determine if any webshells have been downloaded.

        For determining if there is usage of the vulnerability on your servers, you can use the following XQL query (**ensure to enter the Agent IDs list in the right place**):

        Query:

        ```config case_sensitive = false timeframe=7d
        | dataset = xdr_data
        | filter agent_id in (${agentsidstocheck})
        | filter event_type = ENUM.FILE and event_sub_type in (ENUM.FILE_WRITE, ENUM.FILE_CREATE_NEW)
        | filter action_file_path contains "program files\common files\microsoft shared\web server extensions\*\template\layouts\"
        | alter is_known_exploit = if(action_file_path contains "spinstall0.aspx" or action_file_path contains "debug_dev.js" , "Yes" , "Unknown file")
        | fields agent_id,agent_hostname,action_file_path,is_known_exploit
        | dedup action_file_path```

        If the query output indicates possible activity with file/s, investigate those files and quarantine/remove them as needed.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "97"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1370,
          "y": 3300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "87":
    id: "87"
    taskid: fff19fc7-69ce-4d60-8ff6-610995b2c57a
    type: regular
    task:
      id: fff19fc7-69ce-4d60-8ff6-610995b2c57a
      version: -1
      name: Mitigation Actions
      description: "## Suggested Mitigation Steps\n\n### Patch Recommendations For Microsoft SharePoint: \n\n**Apply Patches Immediately**\n\nNote: If any vulnerable servers are found, it is recommended to isolate them until patching is complete.\n\n  * [CVE-2025-49706](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706)\n  * [CVE-2025-49704](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704)\n  * [CVE-2025-53770](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770)\n* [CVE-2025-53771](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771)\n * [Recommendation from Microsoft regarding  CVE-2025-53770](https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/)\n\n\n#### For CVE-2025-53770, there are additional instructions that should be taken as well:\n\n**Rotate SharePoint Server ASP.NET machine keys**\n\nAfter applying the latest security updates above or enabling AMSI, it is critical that customers rotate SharePoint server ASP.NET machine keys and restart IIS on all SharePoint servers. Follow the PowerShell guidance in Improved ASP.NET view state security and key management.\n\nTo update the machine keys for a web application using PowerShell:\n\nGenerate the machine key in PowerShell using Set-SPMachineKey -WebApplication <SPWebApplicationPipeBind>.\nDeploy the machine key to the farm in PowerShell using Update-SPMachineKey -WebApplication <SPWebApplicationPipeBind>.\nAfter the rotation has completed, restart IIS on all SharePoint servers using iisreset.exe.\n\nIf you cannot enable AMSI, you will need to rotate your keys after you install the new security update.\n\n\n### Detection Rules - Snort and Sigma: \n*[Reference](https://www.reddit.com/r/cybersecurity/comments/1m4i3oi/microsoft_sharepoint_server_rce_vulnerability/)*\n\n#### Snort Rule:\n```\nalert tcp any any -> any 80 (msg:\"Possible SharePoint Deserialization Attack\"; \ncontent:\"POST\"; http_method; content:\"/_layouts/\"; http_uri; \ncontent:\"application/json\"; http_header; sid:1000001; rev:1;)\n```\n\n#### Sigma Rule:\n```\ntitle: SharePoint Deserialization Attack\nstatus: experimental\ndescription: Detects potential SharePoint deserialization attacks\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-method: 'POST'\n        cs-uri-stem|contains: '/_layouts/'\n        c-ip|cidr: '!10.0.0.0/8'\n    condition: selection\nfalsepositives:\n    - Legitimate SharePoint usage\nlevel: high\n```\n\n\n#### YARA\n[Find corresponding Yara rules](https://github.com/Neo23x0/signature-base/blob/master/yara/expl_sharepoint_jul25.yar)"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 775,
          "y": 5340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "92":
    id: "92"
    taskid: 187a524a-5dfe-4571-98c8-1a4a9e8b88d4
    type: regular
    task:
      id: 187a524a-5dfe-4571-98c8-1a4a9e8b88d4
      version: -1
      name: Set agent IDs to alert context
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      agentsid:
        complex:
          root: PossibleSPServers.results
          accessor: agent_id
          transformers:
          - operator: uniq
          - operator: StringifyArray
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2090,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "93":
    id: "93"
    taskid: 3ee9a26f-4e7a-4147-8309-4d418f4e0d0c
    type: condition
    task:
      id: 3ee9a26f-4e7a-4147-8309-4d418f4e0d0c
      version: -1
      name: ' Are there any suspicious findings?'
      description: Check if there are any suspicious findings collected during the investigation
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "95"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Potential_suspicious_files
            iscontext: true
          right:
            value: {}
        - operator: containsGeneral
          left:
            value:
              simple: UsedExploit
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
        - operator: containsGeneral
          left:
            value:
              simple: FoundAlerts
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
        - operator: containsGeneral
          left:
            value:
              simple: AlertsDetectedOnHosts
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 4825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "94":
    id: "94"
    taskid: 53427fa5-bb77-4806-8ff3-4754d46a2fe9
    type: regular
    task:
      id: 53427fa5-bb77-4806-8ff3-4754d46a2fe9
      version: -1
      name: Set Potential File Paths
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "97"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Potential_suspicious_files
      value:
        simple: ${XQLPossibleMaliciousFiles.results.action_file_path}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 3300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "95":
    id: "95"
    taskid: fcb9c39f-ff41-48fd-8f8c-3246965d4c06
    type: regular
    task:
      id: fcb9c39f-ff41-48fd-8f8c-3246965d4c06
      version: -1
      name: Manual Actions - Analyst attention required
      description: "As part of the playbook, we have identified possible malicious activity related to the above-mentioned CVEs. Therefore, we strongly suggest reviewing the finding:\n\n### Network Events \nIn this section, we provide any found of the CVEs as a part of network hunting. The list below (if there are any findings, otherwise this section remains empty):\n\n```${NetworkArtifacts.results.exploit_type}```\n```${DotNetTelemetry.results.event_thread_context}```\n\nFor more information, check the \"XQL Network Artifacts query\" task results.\n\n### Webshell Artifacts \npotential webshells (aspx) that might be in the same directory **\"/_layouts\"** or **\"/_catalogs\"**.\nSince we can't determine with strong confidence that those files are webshells, we suggest that you investigate them and quarantine as needed. For more information, check the \"XQL Query - Search possible webshells\" task results.\n\nList of files (if there are any findings; otherwise this section remains empty):\n\n```${Potential_suspicious_files}```\n\n### Suspicious activity detected on hosts\nAs part of the investigation, we've searched for malicious activity that can indicate the use of the exploit. Here is the list of alert names detected on investigated hosts (if there are any findings; otherwise this section remains empty):\n\n```${foundAlerts.name}```\n\n For more information, check the \"Search Related Alerts on Hosts\" task results.\n\n### List of agent IDs identified (If any found):\n```${agentsidstocheck}```\n\n**Recommended action: Isolate vulnerable servers until patching is complete.**"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 5020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "97":
    id: "97"
    taskid: 40b64c8e-ea25-433a-89cc-f1d9579f19ae
    type: title
    task:
      id: 40b64c8e-ea25-433a-89cc-f1d9579f19ae
      version: -1
      name: Finished Analysis
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3120,
          "y": 3475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "99":
    id: "99"
    taskid: a7545220-6711-4193-897a-2d1dfc345f51
    type: condition
    task:
      id: a7545220-6711-4193-897a-2d1dfc345f51
      version: -1
      name: Any results from threat hunting?
      description: Any results from Threat Hunting?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "38"
      "yes":
      - "102"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: IOCFound
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
        - operator: isNotEmpty
          left:
            value:
              simple: Panorama.Monitor.Logs.ID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 5340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "102":
    id: "102"
    taskid: c15c99ba-3d26-455d-8215-12469fbe07d5
    type: regular
    task:
      id: c15c99ba-3d26-455d-8215-12469fbe07d5
      version: -1
      name: Review Threat Hunting Results
      description: "As part of our IOC hunting, we've identified results that need your attention:\nThe results can be found in the Context under `HuntIOCs.Results` key \nor check the results of the task - \"XQL Query - IOCs Hunt\"\n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1575,
          "y": 5530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "103":
    id: "103"
    taskid: c0489d9c-d02a-4514-8e61-faab0222ca99
    type: collection
    task:
      id: c0489d9c-d02a-4514-8e61-faab0222ca99
      version: -1
      name: Any results from the manual XQL?
      description: Display any results from the manual XQL query.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "104"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1210,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body: {}
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Provide the agent IDs for those machines. If you have multiple endpoints, enter them as comma-separated values.
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg:
        - simple: "Yes"
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Have you found any SharePoint servers that might be vulnerable?
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "104":
    id: "104"
    taskid: 3f99aa3d-60ad-415d-91e7-486c9ae2d479
    type: regular
    task:
      id: 3f99aa3d-60ad-415d-91e7-486c9ae2d479
      version: -1
      name: Set Agent IDs to Alert Context
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      agentsid:
        simple: ${Have you found any SharePoint servers that might be vulnerable?.Answers.0}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1210,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "108":
    id: "108"
    taskid: e09d3cfe-36d6-45b5-85a9-b838622b3137
    type: regular
    task:
      id: e09d3cfe-36d6-45b5-85a9-b838622b3137
      version: -1
      name: XQL Query - IOCs Hunt
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "121"
      '#none#':
      - "110"
    scriptarguments:
      extend-context:
        simple: HuntIOCs=
      ignore-outputs:
        simple: "true"
      max_fields:
        simple: "100"
      query:
        simple: config timeframe = 1h case_sensitive = false | datamodel dataset=* | FILTER   XDM_ALIAS.ip in (${ExtractedIndicators.IP=>'"'+val.join('","')+'"'}) or ( XDM_ALIAS.file_hash in (${ExtractedIndicators.File=>'"'+val.join('","')+'"'})) | fields fieldset.xdm_core, xdm.intermediate.ipv4, xdm.source.host.ipv4_addresses, xdm.target.host.ipv4_addresses, xdm.intermediate.host.ipv4_addresses, xdm.network.dhcp.ciaddr, xdm.network.dhcp.yiaddr, xdm.network.dhcp.siaddr, xdm.network.dhcp.giaddr, xdm.network.vpn.allocated_ipv4, xdm.source.ipv6, xdm.target.ipv6, xdm.intermediate.ipv6, xdm.source.host.ipv6_addresses, xdm.target.host.ipv6_addresses, xdm.intermediate.host.ipv6_addresses, xdm.network.vpn.allocated_ipv6, xdm.source.process.executable.md5, xdm.source.process.executable.sha256, xdm.target.process.executable.md5, xdm.target.process.executable.sha256, xdm.intermediate.process.executable.md5, xdm.intermediate.process.executable.sha256, xdm.target.module.md5, xdm.target.module.sha256, xdm.target.file.md5, xdm.target.file.sha256, xdm.target.file_before.md5, xdm.target.file_before.sha256
      query_name:
        simple: IOCs search
      time_frame:
        simple: 1 week ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 500,
          "y": 4160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "109":
    id: "109"
    taskid: 42975a0e-d175-4c66-a8ff-82e605acbe01
    type: condition
    task:
      id: 42975a0e-d175-4c66-a8ff-82e605acbe01
      version: -1
      name: Is the integration of 'XQL Query Engine' available?
      description: Returns 'yes' if integration brand 'XQL Query Engine' is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "121"
      "yes":
      - "111"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3635
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "110":
    id: "110"
    taskid: 13077945-6f23-4bd5-8f85-f52e7ba5862f
    type: condition
    task:
      id: 13077945-6f23-4bd5-8f85-f52e7ba5862f
      version: -1
      name: Any results from XQL?
      description: ' Checks if Threat Hunting found threats.'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "113"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: HuntIOCs.results
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 4335
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "111":
    id: "111"
    taskid: f95af0cd-2f9a-484e-81fa-249bc5277cb2
    type: regular
    task:
      id: f95af0cd-2f9a-484e-81fa-249bc5277cb2
      version: -1
      name: Check XQL Quota
      description: Retrieve the amount of query quota available and used.
      script: '|||xdr-xql-get-quota'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "112"
    scriptarguments:
      extend-context:
        simple: PaloAltoNetworksXQL.Quota4=
      ignore-outputs:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 3810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "112":
    id: "112"
    taskid: 3c83b693-2522-4eda-8972-1a0bbb84d5d8
    type: condition
    task:
      id: 3c83b693-2522-4eda-8972-1a0bbb84d5d8
      version: -1
      name: Is there enough quota?
      description: Check if there is enough quota to run the query.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "121"
      "yes":
      - "108"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: PaloAltoNetworksXQL.Quota4
                accessor: license_quota
                transformers:
                - operator: LastArrayElement
                - operator: subtraction
                  args:
                    by:
                      value:
                        simple: PaloAltoNetworksXQL.Quota4.used_quota
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: "1"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 3955
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "113":
    id: "113"
    taskid: 6adbb2fc-3b80-4c8d-801f-d61a2743a29d
    type: regular
    task:
      id: 6adbb2fc-3b80-4c8d-801f-d61a2743a29d
      version: -1
      name: Set Context key on Found IOCs
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      key:
        simple: IOCFound
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 4520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "114":
    id: "114"
    taskid: e70b3c79-1734-406f-8d57-63c76eacc2f7
    type: title
    task:
      id: e70b3c79-1734-406f-8d57-63c76eacc2f7
      version: -1
      name: Exploitation via Network Events
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "116"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2425,
          "y": 2265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "115":
    id: "115"
    taskid: 0f19f440-f72e-422e-89eb-8f9ee6f83252
    type: regular
    task:
      id: 0f19f440-f72e-422e-89eb-8f9ee6f83252
      version: -1
      name: XQL Query - Network Events
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "123"
      '#none#':
      - "117"
    scriptarguments:
      extend-context:
        simple: NetworkArtifacts=
      ignore-outputs:
        simple: "true"
      max_fields:
        simple: "100"
      query:
        simple: "config timeframe = 7d case_sensitive = false \n| dataset = *\n| filter (http_method = \"POST\" and http_req_uri contains \"/_layouts/*/ToolPane.aspx\")\nor (http_method = \"GET\" and http_req_uri contains \"/_layouts/*/spinstall0.aspx\")\n| alter exploit_type = if(http_referer contains \"/_layouts/SignOut.aspx\", \"RCE and unauthenticated\" , \"RCE\")\n| fields agent_hostname, http_referer, http_method, actor_process_image_name, _time  ,http_req_uri\n| sort desc _time "
      query_name:
        simple: Check if there was an attempt to use the exploit
      time_frame:
        simple: 1 week ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 2680,
          "y": 2950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "116":
    id: "116"
    taskid: f2b35ef9-ee62-4f63-9c22-a19a76ab6411
    type: condition
    task:
      id: f2b35ef9-ee62-4f63-9c22-a19a76ab6411
      version: -1
      name: Is the integration of 'XQL Query Engine' available?
      description: Returns 'yes' if integration brand 'XQL Query Engine' is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "123"
      "yes":
      - "118"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2425,
          "y": 2405
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "117":
    id: "117"
    taskid: d99d2b0f-faf0-4550-886c-1ee4abbcd2d6
    type: condition
    task:
      id: d99d2b0f-faf0-4550-886c-1ee4abbcd2d6
      version: -1
      name: Any results from XQL?
      description: Any results from the XQL Query?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "97"
      "yes":
      - "120"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: NetworkArtifacts.results
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2680,
          "y": 3125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "118":
    id: "118"
    taskid: 2046432e-2e67-431a-886d-9528f3c44227
    type: regular
    task:
      id: 2046432e-2e67-431a-886d-9528f3c44227
      version: -1
      name: Check XQL Quota
      description: Retrieve the amount of query quota available and used.
      script: '|||xdr-xql-get-quota'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "119"
    scriptarguments:
      extend-context:
        simple: PaloAltoNetworksXQL.Quota3=
      ignore-outputs:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2567.5,
          "y": 2600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "119":
    id: "119"
    taskid: 9a0ecff6-a3cb-4f71-8c89-83798806ff87
    type: condition
    task:
      id: 9a0ecff6-a3cb-4f71-8c89-83798806ff87
      version: -1
      name: Is there enough quota?
      description: Check if there is enough quota to run the query.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "123"
      "yes":
      - "115"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: PaloAltoNetworksXQL.Quota3
                accessor: license_quota
                transformers:
                - operator: LastArrayElement
                - operator: subtraction
                  args:
                    by:
                      value:
                        simple: PaloAltoNetworksXQL.Quota3.used_quota
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: "1"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2567.5,
          "y": 2775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "120":
    id: "120"
    taskid: 1532679e-8238-469b-8ad8-200bf52aeeb3
    type: regular
    task:
      id: 1532679e-8238-469b-8ad8-200bf52aeeb3
      version: -1
      name: Set Found Exploit Activity
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "97"
    scriptarguments:
      key:
        simple: UsedExploit
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2680,
          "y": 3300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "121":
    id: "121"
    taskid: 792511ae-11c8-4b66-856e-d6ad723a166f
    type: regular
    task:
      id: 792511ae-11c8-4b66-856e-d6ad723a166f
      version: -1
      name: Manual – Search For IOCs
      description: |
        Dear Analyst,

        Ensure that the 'XQL Query Engine' integration is active. If it's not enabled, activate the integration or manually run the following XQL query to determine if any IOCs are found within your environment. Otherwise, you can go ahead and search manually for the following indicators:

        #### List of IPs:
        ${ExtractedIndicators.IP=>val.join(',')}

        #### List of Hashes:
        ${ExtractedIndicators.File=>val.join(',')}



        XQL Query:
        ```
        config timeframe = 1h case_sensitive = false | datamodel dataset=* | FILTER   XDM_ALIAS.ip in(${ExtractedIndicators.IP=>val.join(',')}) or  ( XDM_ALIAS.file_hash in(${ExtractedIndicators.File=>val.join(',')}) | fields fieldset.xdm_core, xdm.intermediate.ipv4, xdm.source.host.ipv4_addresses, xdm.target.host.ipv4_addresses, xdm.intermediate.host.ipv4_addresses, xdm.network.dhcp.ciaddr, xdm.network.dhcp.yiaddr, xdm.network.dhcp.siaddr, xdm.network.dhcp.giaddr, xdm.network.vpn.allocated_ipv4, xdm.source.ipv6, xdm.target.ipv6, xdm.intermediate.ipv6, xdm.source.host.ipv6_addresses, xdm.target.host.ipv6_addresses, xdm.intermediate.host.ipv6_addresses, xdm.network.vpn.allocated_ipv6, xdm.source.process.executable.md5, xdm.source.process.executable.sha256, xdm.target.process.executable.md5, xdm.target.process.executable.sha256, xdm.intermediate.process.executable.md5, xdm.intermediate.process.executable.sha256, xdm.target.module.md5, xdm.target.module.sha256, xdm.target.file.md5, xdm.target.file.sha256, xdm.target.file_before.md5, xdm.target.file_before.sha256
        ```
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 4335
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "123":
    id: "123"
    taskid: 87c62bdd-da63-4587-8aa0-9f42780dbeb1
    type: regular
    task:
      id: 87c62bdd-da63-4587-8aa0-9f42780dbeb1
      version: -1
      name: Manual – Check for exploitation in your environment
      description: "Dear Analyst,\n\nEnsure that the 'XQL Query Engine' integration is active. If it's not enabled, activate the integration or manually run the following XQL query to determine if there was an attempt to use one of the CVEs.\n\n\nXQL Query:\n```\nconfig timeframe = 7d case_sensitive = false \n| dataset = *\n| filter (http_method = \"POST\" and http_req_uri contains \"/_layouts/*/ToolPane.aspx\")\nor (http_method = \"GET\" and http_req_uri contains \"/_layouts/*/spinstall0.aspx\")\n| alter exploit_type = if(http_referer contains \"/_layouts/SignOut.aspx\", \"RCE and unauthenticated\" , \"RCE\")\n| fields agent_hostname, http_referer, http_method, actor_process_image_name, _time  ,http_req_uri\n| sort desc _time \n```\n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "97"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 3125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "124":
    id: "124"
    taskid: 220fa7a6-751a-45be-8910-ba76bbe636bf
    type: regular
    task:
      id: 220fa7a6-751a-45be-8910-ba76bbe636bf
      version: -1
      name: Collect Indicators from Unit42 Blog
      description: This script extracts indicators from HTML and handles bad TLDs to avoid file extension false positives.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      unescape_domain:
        simple: "False"
      url:
        simple: https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 2425
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "125":
    id: "125"
    taskid: 370a3c84-6907-4c48-8ba9-77bfded45687
    type: title
    task:
      id: 370a3c84-6907-4c48-8ba9-77bfded45687
      version: -1
      name: Exploitation via .Net Telemetry
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "127"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3295,
          "y": 2265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "126":
    id: "126"
    taskid: c0454b7e-1ded-46e2-8c9f-fac77542fac0
    type: regular
    task:
      id: c0454b7e-1ded-46e2-8c9f-fac77542fac0
      version: -1
      name: XQL Query - .Net Telemetry
      description: This XQL query leverages DotNet telemetry to identify references to ToolPane.exe, and extracts fields to provide additional context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "132"
      '#none#':
      - "128"
    scriptarguments:
      extend-context:
        simple: DotNetTelemetry=
      ignore-outputs:
        simple: "true"
      max_fields:
        simple: "100"
      query:
        simple: |-
          dataset = xdr_data
          | fields _time, agent_hostname, actor_effective_username, actor_process_image_name, actor_process_image_path, actor_process_command_line, dynamic_event_string_map, event_thread_context, event_type
          | filter event_type = ENUM.DOT_NET and actor_process_image_name = "w3wp.exe" and event_thread_context contains "ToolPane.aspx"
          | alter IIS_appName = arrayindex(regextract(actor_process_command_line, "\-ap\s+\"([^\"]+)\""), 0)
          | alter EventSrcIP = trim(json_extract(dynamic_event_string_map, "$.27"), "\""),
                  RequestURI = trim(json_extract(dynamic_event_string_map, "$.26"), "\""),
                  Payload = trim(json_extract(dynamic_event_string_map, "$.30"), "\""),
                  Headers = trim(json_extract(dynamic_event_string_map, "$.32"), "\"")
          | alter x_forwarded_for_header = regextract(lowercase(Headers), "\|(?:client-ip|x-forwarded-for)\:((?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[1-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])){3})\|")
          | fields _time, agent_hostname, actor_effective_username, actor_process_image_path, actor_process_command_line, IIS_appName, dynamic_event_string_map, event_thread_context, EventSrcIP, x_forwarded_for_header, RequestURI, Payload, Headers
      query_name:
        simple: Check if there was an attempt to use the exploit via DotNet telemetry
      time_frame:
        simple: 1 week ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 3570,
          "y": 2950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "127":
    id: "127"
    taskid: 2eb443b6-2f6e-43f6-ac0c-a99f7f4ae1da
    type: condition
    task:
      id: 2eb443b6-2f6e-43f6-ac0c-a99f7f4ae1da
      version: -1
      name: Is the integration of 'XQL Query Engine' available?
      description: Returns 'yes' if integration brand 'XQL Query Engine' is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "132"
      "yes":
      - "129"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3295,
          "y": 2425
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "128":
    id: "128"
    taskid: 67c735e8-2cad-4825-84e6-cdb6823c4bda
    type: condition
    task:
      id: 67c735e8-2cad-4825-84e6-cdb6823c4bda
      version: -1
      name: Any results from XQL?
      description: Any results from the XQL Query?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "97"
      "yes":
      - "131"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: DotNetTelemetry.results
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3570,
          "y": 3130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "129":
    id: "129"
    taskid: 5c9d2fa8-f3b9-4420-834d-9be02b883757
    type: regular
    task:
      id: 5c9d2fa8-f3b9-4420-834d-9be02b883757
      version: -1
      name: Check XQL Quota
      description: Retrieve the amount of query quota available and used.
      script: '|||xdr-xql-get-quota'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "130"
    scriptarguments:
      extend-context:
        simple: PaloAltoNetworksXQL.Quota5=
      ignore-outputs:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3457.5,
          "y": 2600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "130":
    id: "130"
    taskid: 1759a717-219a-4091-864f-6b2038a64cb3
    type: condition
    task:
      id: 1759a717-219a-4091-864f-6b2038a64cb3
      version: -1
      name: Is there enough quota?
      description: Check if there is enough quota to run the query.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "132"
      "yes":
      - "126"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: PaloAltoNetworksXQL.Quota5
                accessor: license_quota
                transformers:
                - operator: LastArrayElement
                - operator: subtraction
                  args:
                    by:
                      value:
                        simple: PaloAltoNetworksXQL.Quota5.used_quota
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: "1"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3457.5,
          "y": 2775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "131":
    id: "131"
    taskid: 9f472d27-d5f7-4599-8d20-fdf4cb350f81
    type: regular
    task:
      id: 9f472d27-d5f7-4599-8d20-fdf4cb350f81
      version: -1
      name: Set Found Exploit Activity
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "97"
    scriptarguments:
      key:
        simple: UsedExploit
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3712.5,
          "y": 3300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "132":
    id: "132"
    taskid: d880d589-ea5c-45ae-8ccb-c581cb37e03a
    type: regular
    task:
      id: d880d589-ea5c-45ae-8ccb-c581cb37e03a
      version: -1
      name: Manual – Check for exploitation in your environment
      description: |
        Dear Analyst,

        Ensure that the 'XQL Query Engine' integration is active. If it's not enabled, activate the integration or manually run the following XQL query to determine if there was an attempt to use one of the CVEs.



        XQL Query:
        ```
        // Description: This query leverages DotNet telemetry to identify references to ToolPane.exe, and extracts fields to provide additional context.
        dataset = xdr_data
        | fields _time, agent_hostname, actor_effective_username, actor_process_image_name, actor_process_image_path, actor_process_command_line, dynamic_event_string_map, event_thread_context, event_type
        | filter event_type = ENUM.DOT_NET and actor_process_image_name = "w3wp.exe" and event_thread_context contains "ToolPane.aspx"

        // Extract the IIS application pool name from command line
        | alter IIS_appName = arrayindex(regextract(actor_process_command_line, "\-ap\s+\"([^\"]+)\""), 0)

        // Extract fields from the dynamic_string_string_map:
        // EventSrcIP - Logged IP address by the IIS server
        // RequestURI - The requested URL by the threat actor
        // Payload - The time he decoded .NET payload from exploitation
        // Headers - HTTP request headers
        | alter EventSrcIP = trim(json_extract(dynamic_event_string_map, "$.27"), "\""),
                RequestURI = trim(json_extract(dynamic_event_string_map, "$.26"), "\""),
                Payload = trim(json_extract(dynamic_event_string_map, "$.30"), "\""),
                Headers = trim(json_extract(dynamic_event_string_map, "$.32"), "\"")

        // Extract the X-Forwarded-For headers from the Headers field in an attempt to identify the source of exploitation
        | alter x_forwarded_for_header = regextract(lowercase(Headers), "\|(?:client-ip|x-forwarded-for)\:((?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[1-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])){3})\|")

        | fields _time, agent_hostname, actor_effective_username, actor_process_image_path, actor_process_command_line, IIS_appName, dynamic_event_string_map, event_thread_context, EventSrcIP, x_forwarded_for_header, RequestURI, Payload, Headers
        ```
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "97"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3120,
          "y": 3125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "133":
    id: "133"
    taskid: 22a54ddf-8396-45c5-8e23-dfe79e03ce72
    type: regular
    task:
      id: 22a54ddf-8396-45c5-8e23-dfe79e03ce72
      version: -1
      name: Set Potential Agent IDs to search on
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "72"
    scriptarguments:
      key:
        simple: agentsidstocheck
      stringify:
        simple: "true"
      value:
        complex:
          root: incident
          accessor: agentid
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: incident.agentsid
                iscontext: true
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
          - operator: join
            args:
              separator:
                value:
                  simple: '","'
          - operator: concat
            args:
              prefix:
                value:
                  simple: '"'
              suffix:
                value:
                  simple: '"'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2422.5,
          "y": 1925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "134":
    id: "134"
    taskid: 5c462117-626a-411b-827f-efa249e7b42f
    type: title
    task:
      id: 5c462117-626a-411b-827f-efa249e7b42f
      version: -1
      name: Search For Related Alerts On Hosts
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "139"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4092.5,
          "y": 2265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "135":
    id: "135"
    taskid: 31e92cde-9ae2-4b95-8b7e-b823ee32c545
    type: regular
    task:
      id: 31e92cde-9ae2-4b95-8b7e-b823ee32c545
      version: -1
      name: Search For Related Alerts On Hosts
      description: "Searches Demisto incidents. A summarized version of this scrips is available with the summarizedversion argument.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script\nhttps://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations"
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "136"
    scriptarguments:
      extend-context:
        simple: SrcHostRelatedAlerts=
      fromdate:
        simple: 3 hours ago
      ignore-outputs:
        simple: "true"
      includeinformational:
        simple: "false"
      query:
        simple: ${agentsidstocheck2=>"(agentid:"+val.join(" or agentid:")+")"} and (name:"IIS Protection - 1068402429" or name:"SYNC - Webserver Exploitation - 881462404" or ((severity:"HIGH" or severity:"MEDIUM" or severity:"CRITICAL") and mitreattcktechnique:"T1059.001"))
      todate:
        simple: now
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4092.5,
          "y": 2950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "136":
    id: "136"
    taskid: ac5b121d-8a80-43e1-8395-8323cf6b9ca7
    type: condition
    task:
      id: ac5b121d-8a80-43e1-8395-8323cf6b9ca7
      version: -1
      name: Any related alerts found?
      description: Check if there are any related alerts found from the previous search that could indicate potential exploit activities.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "97"
      "yes":
      - "137"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: foundIncidents.name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4092.5,
          "y": 3130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "137":
    id: "137"
    taskid: 2fcf8145-f4b2-4c96-8efb-5705773bcbda
    type: regular
    task:
      id: 2fcf8145-f4b2-4c96-8efb-5705773bcbda
      version: -1
      name: Set Evidence Key To context
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "97"
    scriptarguments:
      key:
        simple: AlertsDetectedOnHosts
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4312.5,
          "y": 3300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "138":
    id: "138"
    taskid: 985dc562-1311-4f8a-8df7-f06d6c2cdaca
    type: playbook
    task:
      id: 985dc562-1311-4f8a-8df7-f06d6c2cdaca
      version: -1
      name: Panorama Query Logs for Related Session
      description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.'
      playbookName: Panorama Query Logs
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      log_type:
        simple: threat
      query:
        simple: '(threatid eq 96436) or (threatid eq 96481) '
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 3985
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "139":
    id: "139"
    taskid: 87c1c9c8-084b-4197-89b8-f7612b4c4aca
    type: regular
    task:
      id: 87c1c9c8-084b-4197-89b8-f7612b4c4aca
      version: -1
      name: Set Potential Agent IDs to search on
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "135"
    scriptarguments:
      key:
        simple: agentsidstocheck2
      value:
        complex:
          root: alert
          accessor: agentid
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: incident.agentsid
                iscontext: true
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4092.5,
          "y": 2775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "140":
    id: "140"
    taskid: d61db944-f1e3-4a60-90f6-85293019ab91
    type: playbook
    task:
      id: d61db944-f1e3-4a60-90f6-85293019ab91
      version: -1
      name: Block Indicators - Generic v3
      description: |-
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2.
      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      AutoBlockIndicators:
        simple: "True"
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: ExtractedIndicators
          accessor: Domain
          transformers:
          - operator: uniq
      FilesToBlock:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
      IP:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      InputEnrichment:
        simple: "False"
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      Tag:
        simple: Blocked Indicator In Systems
      URL:
        complex:
          root: ExtractedIndicators
          accessor: URL
          transformers:
          - operator: uniq
      UserVerification:
        simple: "False"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1575,
          "y": 5010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "109_121_#default#": 0.42,
      "110_113_yes": 0.4,
      "110_28_#default#": 0.13,
      "112_121_#default#": 0.52,
      "115_123_#error#": 0.61,
      "116_118_yes": 0.38,
      "116_123_#default#": 0.35,
      "117_97_#default#": 0.22,
      "119_115_yes": 0.31,
      "119_123_#default#": 0.54,
      "126_132_#error#": 0.26,
      "127_129_yes": 0.41,
      "127_132_#default#": 0.35,
      "128_97_#default#": 0.13,
      "130_126_yes": 0.39,
      "130_132_#default#": 0.49,
      "136_97_#default#": 0.4,
      "1_2_#error#": 0.33,
      "4_9_#default#": 0.12,
      "6_2_#default#": 0.28,
      "72_73_yes": 0.61,
      "74_79_#error#": 0.31,
      "75_79_#default#": 0.4,
      "78_79_#default#": 0.54,
      "93_31_#default#": 0.44,
      "93_95_yes": 0.53,
      "99_38_#default#": 0.44
    },
    "paper": {
      "dimensions": {
        "height": 6195,
        "width": 4642.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
inputSections:
- inputs: []
  name: General (Inputs group)
  description: Generic group for inputs
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0