Cortex XDR - CVE-2025-59287 - Microsoft WSUS Remote Code Execution

CVE-2025-59287 - Microsoft WSUS Remote Code Execution ## Vulnerability Overview - **Vulnerability Name**: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability - **CVE ID**: CVE-2025-59287 - **CVSS Score**: 9.8 (Critical) An unauthenticated remote code execution (RCE) vulnerability has been identified in Microsoft Windows Server Update Services (WSUS). [Source: Unit42 - Palo Alto Networks](https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/) ## Mitigation and Recommendations - **Apply Patch** - **Restrict Access** to the vulnerable serves - **Monitor for IoCs and suspicious traffic** ## Conclusion CVE‑2025‑59287 is a critical, remotely exploitable vulnerability in WSUS that allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges. [View official CVE details on NIST](https://nvd.nist.gov/vuln/detail/CVE-2025-59287) ## Playbook Triggers - Manually ## Playbook Flow 1. Uses XQL to identify WSUS servers in your environment. 2. Collects IOCs from the Unit42 blog. 3. Uses XQL to detect any suspicious command lines indicative of exploitation of this vulnerability. 4. Investigates the command lines to identify malicious indicators related to the vulnerability. 5. Uses XQL to hunt for malicious IOCs. 6. Isolates compromised WSUS servers. 7. Blocks malicious indicators using the "Block Indicators - Generic v3" playbook. 8. Provides mitigation recommendations.
CVE-2025-59287 - Microsoft WSUS Remote Code Execution · 54 tasks · 0 inputs · 0 outputs
Details

ID	`Cortex XDR - CVE-2025-59287 - Microsoft WSUS Remote Code Execution`
From Version	6.10.0
Tasks	54
Tags	Rapid Breach Response CVE-2025-59287
README

CVE-2025-59287 - Microsoft WSUS Remote Code Execution
Vulnerability Overview

Vulnerability Name: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
CVE ID: CVE-2025-59287
CVSS Score: 9.8 (Critical)
An unauthenticated remote code execution (RCE) vulnerability has been identified in Microsoft Windows Server Update Services (WSUS).
Source: Unit42 - Palo Alto Networks
Mitigation and Recommendations

Apply Patch
Restrict Access to the vulnerable serves
Monitor for IoCs and suspicious traffic
Conclusion

CVE‑2025‑59287 is a critical, remotely exploitable vulnerability in WSUS that allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges.
View official CVE details on NIST
Playbook Triggers

Manually
Playbook Flow

Uses XQL to identify WSUS servers in your environment.
Collects IOCs from the Unit42 blog.
Uses XQL to detect any suspicious command lines indicative of exploitation of this vulnerability.
Investigates the command lines to identify malicious indicators related to the vulnerability.
Uses XQL to hunt for malicious IOCs.
Isolates compromised WSUS servers.
Blocks malicious indicators using the “Block Indicators - Generic v3” playbook.
Provides mitigation recommendations.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Block Indicators - Generic v3
Integrations

This playbook does not use any integrations.
Scripts

CommandLineAnalysis
IsIntegrationAvailable
ParseHTMLIndicators
SetAndHandleEmpty
isolate-endpoint
Commands

associateIndicatorsToIncident
closeInvestigation
createNewIndicator
extractIndicators
setIncident
xdr-xql-generic-query
Playbook Inputs

There are no inputs for this playbook.
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Cortex XDR - CVE-2025-59287 - Microsoft WSUS Remote Code Execution
Commands used

associateIndicatorsToIncident closeInvestigation createNewIndicator extractIndicators setIncident xdr-xql-generic-query
Flowchart

Source

playbook-CVE-2025-59287_-_Microsoft_WSUS_Remote_Code_Execution.yml
Download History Raw
id: Cortex XDR - CVE-2025-59287 - Microsoft WSUS Remote Code Execution
version: -1
name: Cortex XDR - CVE-2025-59287 - Microsoft WSUS Remote Code Execution
description: "CVE-2025-59287 - Microsoft WSUS Remote Code Execution\n\n\n##   Vulnerability Overview\n\n- **Vulnerability Name**: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability\n- **CVE ID**: CVE-2025-59287 \n- **CVSS Score**: 9.8 (Critical)  \n\n\nAn unauthenticated remote code execution (RCE) vulnerability has been identified in Microsoft Windows Server Update Services (WSUS).\n[Source: Unit42 - Palo Alto Networks](https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/)\n\n\n##  Mitigation and Recommendations\n\n- **Apply Patch**\n- **Restrict Access** to the vulnerable serves  \n- **Monitor for IoCs and suspicious traffic**  \n\n##  Conclusion\n\nCVE‑2025‑59287 is a critical, remotely exploitable vulnerability in WSUS that allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges.\n\n[View official CVE details on NIST](https://nvd.nist.gov/vuln/detail/CVE-2025-59287)\n\n##  Playbook Triggers\n- Manually\n\n##  Playbook Flow\n1. Uses XQL to identify WSUS servers in your environment.\n2. Collects IOCs from the Unit42 blog.\n3. Uses XQL to detect any suspicious command lines indicative of exploitation of this vulnerability.\n4. Investigates the command lines to identify malicious indicators related to the vulnerability.\n5. Uses XQL to hunt for malicious IOCs.\n6. Isolates compromised WSUS servers.\n7. Blocks malicious indicators using the \"Block Indicators - Generic v3\" playbook.\n8. Provides mitigation recommendations."
tags:
- Rapid Breach Response
- CVE-2025-59287
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ad255df2-6e4b-49cd-825f-7116e454f8a0
    type: start
    task:
      id: ad255df2-6e4b-49cd-825f-7116e454f8a0
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": -537
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 757c2d12-71b5-4418-8fbd-ca0373e823cc
    type: regular
    task:
      id: 757c2d12-71b5-4418-8fbd-ca0373e823cc
      version: -1
      name: XQL Query - Search for any WSUS servers that might be vulnerable
      description: |
        Execute an XQL query to search all WSUS servers and retrieve their agent IDs.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "2"
      '#none#':
      - "4"
    scriptarguments:
      extend-context:
        simple: PossibleWsusServers=
      ignore-outputs:
        simple: "true"
      max_fields:
        simple: "100"
      query:
        simple: "dataset = xdr_data \n| filter agent_os_type = ENUM.AGENT_OS_WINDOWS and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START \n| filter lowercase(actor_process_image_name) = \"wsusservice.exe\" \nor lowercase(causality_actor_process_image_name) = \"wsusservice.exe\" \nor (lowercase(causality_actor_process_image_name) = \"w3wp.exe\" and lowercase(causality_actor_process_command_line) contains \"wsuspool\") \nor (lowercase(actor_process_image_name) = \"w3wp.exe\" and lowercase(actor_process_command_line) contains \"wsuspool\")\n| fields agent_id\n| dedup agent_id"
      query_name:
        simple: Search for any WSUS servers that might be vulnerable
      time_frame:
        simple: 1 week ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 3675,
          "y": -113
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 1f2f5277-b258-448a-a534-c14b05d1214a
    type: regular
    task:
      id: 1f2f5277-b258-448a-a534-c14b05d1214a
      version: -1
      name: Manual – Search possible hosts
      description: "Dear Analyst,\n\nEnsure that the 'XQL Query Engine' integration is active. If it's not enabled, activate the integration or manually run the following XQL query to determine if any hosts are running a potentially vulnerable product.\n\n**XQL Query**:\nSearch all WSUS servers and retrieve their agent IDs.\n\n```dataset = xdr_data \n| filter agent_os_type = ENUM.AGENT_OS_WINDOWS and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START \n| filter lowercase(actor_process_image_name) = \"wsusservice.exe\" \nor lowercase(causality_actor_process_image_name) = \"wsusservice.exe\" \nor (lowercase(causality_actor_process_image_name) = \"w3wp.exe\" and lowercase(causality_actor_process_command_line) contains \"wsuspool\") \nor (lowercase(actor_process_image_name) = \"w3wp.exe\" and lowercase(actor_process_command_line) contains \"wsuspool\")\n| fields agent_id\n| dedup agent_id \n```\n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "103"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 41
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 2f1c2cf4-130b-472f-9b24-cfe9a122fe83
    type: condition
    task:
      id: 2f1c2cf4-130b-472f-9b24-cfe9a122fe83
      version: -1
      name: Is the integration of 'XQL Query Engine' available?
      description: Returns 'yes' if integration brand 'XQL Query Engine' is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "2"
      "yes":
      - "1"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": -266
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 5491764c-43d5-4f07-8bdd-bcf132e8b79c
    type: condition
    task:
      id: 5491764c-43d5-4f07-8bdd-bcf132e8b79c
      version: -1
      name: Any results from XQL?
      description: Any results from the XQL Query?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "92"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: PossibleWsusServers.results.agent_id
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3675,
          "y": 41
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 79106851-427c-4eb4-8eca-128611c37efb
    type: title
    task:
      id: 79106851-427c-4eb4-8eca-128611c37efb
      version: -1
      name: 'XQL: Identify WSUS servers'
      description: This section identifies Microsoft WSUS servers.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": -401
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 20d7f0fb-5a46-4453-8186-29c5d11f48da
    type: title
    task:
      id: 20d7f0fb-5a46-4453-8186-29c5d11f48da
      version: -1
      name: Collect Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "124"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: cdc182b4-c36a-4af2-843e-e82753d874ae
    type: title
    task:
      id: cdc182b4-c36a-4af2-843e-e82753d874ae
      version: -1
      name: Anlysis Endpoints
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "133"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201,
          "y": 1493
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: e164cb9a-165b-4c18-86ab-85fa70406ac8
    type: regular
    task:
      id: e164cb9a-165b-4c18-86ab-85fa70406ac8
      version: -1
      name: Extract indicators from collected data
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      text:
        complex:
          root: http.parsedBlog
          accessor: indicators
          transformers:
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201,
          "y": 894
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 4e5e3d59-15cd-4f37-8715-d42e97560e8f
    type: title
    task:
      id: 4e5e3d59-15cd-4f37-8715-d42e97560e8f
      version: -1
      name: Tag and Link Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
      - "24"
      - "51"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 010e1859-4242-4886-8263-96c23380c6e6
    type: regular
    task:
      id: 010e1859-4242-4886-8263-96c23380c6e6
      version: -1
      name: Tag URL Indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      retry-count:
        simple: "3"
      retry-interval:
        simple: "2"
      tags:
        simple: CVE-2025-59287
      type:
        simple: URL
      value:
        complex:
          root: ExtractedIndicators.URL
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.URL
                iscontext: true
          transformers:
          - operator: uniq
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3799.25,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 068315d1-c10c-425b-87ae-96da53012ca5
    type: regular
    task:
      id: 068315d1-c10c-425b-87ae-96da53012ca5
      version: -1
      name: Tag CVE Indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      retry-count:
        simple: "3"
      retry-interval:
        simple: "2"
      tags:
        simple: Microsoft WSUS RCE vulnerability
      type:
        simple: CVE
      value:
        complex:
          root: ExtractedIndicators
          accessor: CVE
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 08e09778-2837-4cc0-8f96-0eb0fc5a4876
    type: title
    task:
      id: 08e09778-2837-4cc0-8f96-0eb0fc5a4876
      version: -1
      name: Extract Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201,
          "y": 761
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: ea772b3c-02a5-44d2-895e-718346fb63d2
    type: title
    task:
      id: ea772b3c-02a5-44d2-895e-718346fb63d2
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "150"
      - "163"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 4338
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: f26c6866-53e8-4656-8442-c6e2ca126310
    type: title
    task:
      id: f26c6866-53e8-4656-8442-c6e2ca126310
      version: -1
      name: Mitigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "99"
      - "87"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 5466
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 58b17f49-7822-4538-80c4-5879c674bebf
    type: condition
    task:
      id: 58b17f49-7822-4538-80c4-5879c674bebf
      version: -1
      name: Analysis Resolution - Should continue with the investigation?
      description: |+
        ## Check with the analyst to determine whether to continue the investigation.

        - Verify that Microsoft WSUS is on the affected servers and the patches are implemented.

        - Check if the Threat Hunting steps returned results (if any).

        - Validate that there are no other affected systems, and the Potential attack patterns are investigated.


      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "37"
      "Yes":
      - "36"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 6077
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Do you need to continue with the investigation?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 39404a0e-fb68-47ec-8b75-4ddb00045a83
    type: title
    task:
      id: 39404a0e-fb68-47ec-8b75-4ddb00045a83
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 6388
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 77b6f086-ace7-4400-83a9-b02e44dd7475
    type: regular
    task:
      id: 77b6f086-ace7-4400-83a9-b02e44dd7475
      version: -1
      name: Investigate Further
      description: |
        ## Manual step for further alert investigation.

        - Keep monitoring IOCs for suspicious actions.
        - Check for any additional suspicious artifacts identified during the investigation and continue your analysis on them.
        - Keep monitoring for new [hot-fixes and KBs released by Microsoft](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287) related to this CVE.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3233.75,
          "y": 6225
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 1d5184cd-de4e-4486-851c-64d159fc6f8d
    type: regular
    task:
      id: 1d5184cd-de4e-4486-851c-64d159fc6f8d
      version: -1
      name: Close Investigation
      description: Close the current alert
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      closeReason:
        simple: No further actions are required.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3674.5,
          "y": 6225
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: ff76dc2d-a8ae-4bce-850f-826180e65648
    type: title
    task:
      id: ff76dc2d-a8ae-4bce-850f-826180e65648
      version: -1
      name: Resolution
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 5935
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: d4e58c5d-b60b-40a1-856c-f8f5ce1e3601
    type: regular
    task:
      id: d4e58c5d-b60b-40a1-856c-f8f5ce1e3601
      version: -1
      name: Link Indicators to Alert
      description: commands.local.cmd.associate.indicators
      script: Builtin|||associateIndicatorsToIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      incidentId:
        simple: ${incident.id}
      indicatorsValues:
        complex:
          root: ExtractedIndicators.URL
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.URL
                iscontext: true
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.CVE
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201,
          "y": 1341
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: c4f1ee5f-bc05-4ab4-8f70-8aafc47e8d70
    type: regular
    task:
      id: c4f1ee5f-bc05-4ab4-8f70-8aafc47e8d70
      version: -1
      name: Tag Domain Indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      retry-count:
        simple: "3"
      retry-interval:
        simple: "2"
      tags:
        simple: CVE-2025-59287
      type:
        simple: File
      value:
        complex:
          root: ExtractedIndicators.Domain
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
          transformers:
          - operator: uniq
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4605,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "68":
    id: "68"
    taskid: a5abfbae-676a-4d46-8feb-cb8d00f7020d
    type: title
    task:
      id: a5abfbae-676a-4d46-8feb-cb8d00f7020d
      version: -1
      name: Threat Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "109"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 3490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "72":
    id: "72"
    taskid: fe103744-ecfa-49f8-8a04-6b7ce040321c
    type: condition
    task:
      id: fe103744-ecfa-49f8-8a04-6b7ce040321c
      version: -1
      name: Are there any WSUS hosts?
      description: This task checks if any WSUS hosts are found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "68"
      "yes":
      - "135"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: agentsidstocheck
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201,
          "y": 1814
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: 5c8f23fe-729b-4140-81d7-f4817fef9bcd
    type: regular
    task:
      id: 5c8f23fe-729b-4140-81d7-f4817fef9bcd
      version: -1
      name: XQL Query - Search possible malicious command lines
      description: Execute an XQL query to retrieve possible executed malicious command lines on WSUS servers.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "79"
      '#none#':
      - "138"
    scriptarguments:
      extend-context:
        simple: XQLPossibleMaliciousCmd=
      ignore-outputs:
        simple: "true"
      max_fields:
        simple: "100"
      query:
        simple: "dataset = xdr_data\n| filter agent_id in (${agentsidstocheck})\n| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START\n| filter (lowercase(actor_process_image_name) in (\"wsusservice.exe\",\"w3wp.exe\") and (lowercase(actor_process_image_name) = \"w3wp.exe\" and lowercase(actor_process_command_line) contains \"wsuspool\") or (lowercase(actor_process_image_name) = \"wsusservice.exe\")\nand lowercase(action_process_image_name) in (\"cmd.exe\",\"powershell.exe\"))\nor (causality_actor_process_image_name = \"w3wp.exe\" and causality_actor_process_command_line contains \"wsuspool\" and actor_process_image_name in (\"cmd.exe\",\"powershell.exe\") and lowercase(action_process_image_name) in (\"cmd.exe\",\"powershell.exe\")) \n| fields _time, agent_hostname, agent_id, actor_process_image_name, actor_process_command_line,\n         action_process_image_name, action_process_image_command_line\n| dedup actor_process_command_line, action_process_image_command_line"
      query_name:
        simple: Check for possibles malicious command lines
      time_frame:
        simple: 7 days ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 2285
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "75":
    id: "75"
    taskid: 280cc7f5-c895-4362-a2a4-10104bb22840
    type: condition
    task:
      id: 280cc7f5-c895-4362-a2a4-10104bb22840
      version: -1
      name: Is the integration of 'XQL Query Engine' available?
      description: Returns 'yes' if integration brand 'XQL Query Engine' is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "79"
      "yes":
      - "74"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 2129
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "79":
    id: "79"
    taskid: 59f32596-385a-4b5f-8361-97b66da2a91f
    type: regular
    task:
      id: 59f32596-385a-4b5f-8361-97b66da2a91f
      version: -1
      name: Manual – Search web shells using XQL query and quarantine the files
      description: "Dear Analyst,\n\nEnsure that the 'XQL Query Engine' integration is active. If it's not enabled, activate the integration or manually run the following XQL query to retrieve possible executed malicious command lines on WSUS servers.\n\nYou can use the following XQL query:\n\n**Query:**\nExecute an XQL query to retrieve possible executed malicious command lines on WSUS servers.\n\n```\ndataset = xdr_data\n| filter agent_id in (${agentsidstocheck})\n| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START\n| filter (lowercase(actor_process_image_name) in (\"wsusservice.exe\",\"w3wp.exe\") and (lowercase(actor_process_image_name) = \"w3wp.exe\" and lowercase(actor_process_command_line) contains \"wsuspool\") or (lowercase(actor_process_image_name) = \"wsusservice.exe\")\nand lowercase(action_process_image_name) in (\"cmd.exe\",\"powershell.exe\"))\nor (causality_actor_process_image_name = \"w3wp.exe\" and causality_actor_process_command_line contains \"wsuspool\" and actor_process_image_name in (\"cmd.exe\",\"powershell.exe\") and lowercase(action_process_image_name) in (\"cmd.exe\",\"powershell.exe\")) \n| fields _time, agent_hostname, actor_process_image_name, actor_process_command_line,\n         action_process_image_name, action_process_image_command_line\n| dedup actor_process_command_line, action_process_image_command_line\n```"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "68"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3799.25,
          "y": 2530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "87":
    id: "87"
    taskid: 1157b3e7-6c47-41b0-86c6-4046083b62c0
    type: regular
    task:
      id: 1157b3e7-6c47-41b0-86c6-4046083b62c0
      version: -1
      name: Mitigation Actions
      description: "## Suggested Mitigation Steps\n\n### Patch Recommendations For Microsoft WSUS: \n\n**Apply Patches Immediately**\n\nNote: If any vulnerable servers are found, it is recommended to isolate them until patching is complete.\n\n  * [CVE-2025-59287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287)\n\n\n### Workarounds\nThe following workarounds might be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as possible even if you plan to leave either of these workarounds in place:\n\nIf you are unable to install the October 23, 2025 out-of-band update, you can take any of the following actions to be protected against this vulnerability:\n\nIf the WSUS Server Role is enabled on your server, disable it. Note that clients will no longer receive updates from the server if WSUS is disabled.\nBlock inbound traffic to Ports 8530 and 8531 on the host firewall (as opposed to blocking only at the network/perimeter firewall) to render WSUS non-operational.\n\nImportant: Do NOT undo either of these workarounds until after you have installed the update."
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3263.75,
          "y": 5614
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "92":
    id: "92"
    taskid: faaecd78-d961-42bc-b21d-cb5ec45fdee0
    type: regular
    task:
      id: faaecd78-d961-42bc-b21d-cb5ec45fdee0
      version: -1
      name: Set agent IDs to alert context
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      agentsid:
        complex:
          root: PossibleWsusServers.results
          accessor: agent_id
          transformers:
          - operator: uniq
          - operator: StringifyArray
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3440,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "94":
    id: "94"
    taskid: 76dc0bd4-e2d0-4ba5-8dc6-4d77bf517089
    type: regular
    task:
      id: 76dc0bd4-e2d0-4ba5-8dc6-4d77bf517089
      version: -1
      name: Set parsed malicious command lines
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "161"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MaliciousCommandLinesDetected
      value:
        complex:
          root: CommandLineAnalysis
          filters:
          - - operator: greaterThan
              left:
                value:
                  simple: CommandLineAnalysis.score
                iscontext: true
              right:
                value:
                  simple: "50"
            - operator: containsGeneral
              left:
                value:
                  simple: CommandLineAnalysis.analysis.original.indicators.URL
                iscontext: true
              right:
                value:
                  simple: ExtractedIndicators.URL
                iscontext: true
              ignorecase: true
          accessor: parsed_command
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 3000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "99":
    id: "99"
    taskid: 5ab0095d-056e-4447-8ed3-51e46fbf942e
    type: condition
    task:
      id: 5ab0095d-056e-4447-8ed3-51e46fbf942e
      version: -1
      name: Any results from threat hunting?
      description: Any results from Threat Hunting?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "38"
      "yes":
      - "102"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: IOCFound
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
        - operator: isNotEmpty
          left:
            value:
              simple: DBotScore.Indicator
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3684.5,
          "y": 5614
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "102":
    id: "102"
    taskid: dddf3925-e908-41bd-8e15-f2a55e306e03
    type: regular
    task:
      id: dddf3925-e908-41bd-8e15-f2a55e306e03
      version: -1
      name: Review Threat Hunting Results
      description: |-
        ${IOCFound(val)="As part of our IOC hunting, we've identified results that need your attention: The results can be found in the Context under  HuntIOCs.Results  key or check the results of the task - "XQL Query - IOCs Hunt""}

        ${DBotScore(val.Indicator).Indicator=>"The following indicators were found in the command lines:\n - "+val.filter((v,i,a)=>a.indexOf(v)==i).join("\n - ")+"\n\nPlease Investigate"}
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3913,
          "y": 5770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "103":
    id: "103"
    taskid: e7a0aa55-e655-4415-9ab6-26018f4935b5
    type: collection
    task:
      id: e7a0aa55-e655-4415-9ab6-26018f4935b5
      version: -1
      name: Enter the agent IDs retrieved from the manual XQL query
      description: Enter the agent ID retrieved from the manual execution of the XQL query.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "104"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body: {}
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Provide the agent IDs for those machines. If you have multiple endpoints, enter them as comma-separated values.
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg:
        - simple: "Yes"
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Have you found any WSUS servers that might be vulnerable?
      description: ""
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "104":
    id: "104"
    taskid: 9c06f69d-4aa6-42c5-b593-c87fe5597008
    type: regular
    task:
      id: 9c06f69d-4aa6-42c5-b593-c87fe5597008
      version: -1
      name: Set Agent IDs to Alert Context
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      agentsid:
        simple: ${Have you found any WSUS servers that might be vulnerable?.Answers.0}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 331
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "108":
    id: "108"
    taskid: d72ab5c0-7492-40f8-b5e6-1b18643241a4
    type: regular
    task:
      id: d72ab5c0-7492-40f8-b5e6-1b18643241a4
      version: -1
      name: XQL Query - IOCs Hunt
      description: Execute an XQL query to detect any usage of the specified malicious indicators.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "121"
      '#none#':
      - "110"
    scriptarguments:
      extend-context:
        simple: HuntIOCs=
      ignore-outputs:
        simple: "true"
      max_fields:
        simple: "100"
      query:
        simple: "datamodel dataset=* \n| filter (xdm.network.http.url  in (${ExtractedIndicators.URL=>'\"'+val.join('\",\"')+'\"'}) \nor xdm.target.url in (${ExtractedIndicators.URL=>'\"'+val.join('\",\"')+'\"'}))\n| fields fieldset.xdm_core, xdm.source.host.ipv4_addresses, xdm.target.host.ipv4_addresses, xdm.source.host.device_id, xdm.source.host.hostname"
      query_name:
        simple: IOCs search
      time_frame:
        simple: 1 week ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 3800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "109":
    id: "109"
    taskid: 882edaee-2f52-4483-8f04-6c648d73c0fc
    type: condition
    task:
      id: 882edaee-2f52-4483-8f04-6c648d73c0fc
      version: -1
      name: Is the integration of 'XQL Query Engine' available?
      description: Returns 'yes' if integration brand 'XQL Query Engine' is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "121"
      "yes":
      - "108"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 3621
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "110":
    id: "110"
    taskid: 568d8ad3-fbe2-446d-8347-80c042772994
    type: condition
    task:
      id: 568d8ad3-fbe2-446d-8347-80c042772994
      version: -1
      name: Any results from XQL?
      description: ' Checks if Threat Hunting found threats.'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "113"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: HuntIOCs.results
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 3980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "113":
    id: "113"
    taskid: 042454d3-b8e9-4919-8c4b-e726fab2e0f8
    type: regular
    task:
      id: 042454d3-b8e9-4919-8c4b-e726fab2e0f8
      version: -1
      name: Set Context key on Found IOCs
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      key:
        simple: IOCFound
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3150,
          "y": 4170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "121":
    id: "121"
    taskid: 99930270-0774-4e6d-833e-92f48b6c3f63
    type: regular
    task:
      id: 99930270-0774-4e6d-833e-92f48b6c3f63
      version: -1
      name: Manual – Search For IOCs
      description: "Dear Analyst,\n\nEnsure that the 'XQL Query Engine' integration is active. If it's not enabled, activate the integration or manually run the following XQL query to determine if any IOCs are found within your environment. Otherwise, you can go ahead and search manually for the following indicators:\n\n#### List of URLs:\n${ExtractedIndicators.URL=>val.join(',')}\n\n#### List of Domains:\n${ExtractedIndicators.Domain=>val.join(',')}\n\n\n**XQL Query:**\nSearches for URL indicators.\n```\ndatamodel dataset=* \n| filter (xdm.network.http.url  in (${ExtractedIndicators.URL=>'\"'+val.join('\",\"')+'\"'}) \nor xdm.target.url in (${ExtractedIndicators.URL=>'\"'+val.join('\",\"')+'\"'}))\n| fields fieldset.xdm_core, xdm.source.host.ipv4_addresses, xdm.target.host.ipv4_addresses, agent_id, agent_hostname\n```\n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3913,
          "y": 3980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "124":
    id: "124"
    taskid: 9d310c03-481d-4e9c-80c2-cb25bb54adef
    type: regular
    task:
      id: 9d310c03-481d-4e9c-80c2-cb25bb54adef
      version: -1
      name: Collect Indicators from Unit42 Blog
      description: This script extracts indicators from HTML and handles bad TLDs to avoid file extension false positives.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      unescape_domain:
        simple: "False"
      url:
        simple: https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 609
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "133":
    id: "133"
    taskid: 0eb5edeb-dc01-481c-8fba-e64da69ebc8f
    type: regular
    task:
      id: 0eb5edeb-dc01-481c-8fba-e64da69ebc8f
      version: -1
      name: Set Potential Agent IDs to search on
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "72"
    scriptarguments:
      key:
        simple: agentsidstocheck
      stringify:
        simple: "true"
      value:
        complex:
          root: alert
          accessor: agentid
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: alert.agentsid
                iscontext: true
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
          - operator: join
            args:
              separator:
                value:
                  simple: '","'
          - operator: concat
            args:
              prefix:
                value:
                  simple: '"'
              suffix:
                value:
                  simple: '"'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201,
          "y": 1643
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "134":
    id: "134"
    taskid: c883aa91-651e-4564-b3c2-6269cbbc6a1f
    type: regular
    task:
      id: c883aa91-651e-4564-b3c2-6269cbbc6a1f
      version: -1
      name: Command Line Analysis
      description: |-
        This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows:

        * 0-25: Low Risk
        * 26-50: Medium Risk
        * 51-90: High Risk
        * 91-100: Critical Risk

        The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors.
      scriptName: CommandLineAnalysis
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "145"
    scriptarguments:
      command_line:
        complex:
          root: XQLPossibleMaliciousCmd.results
          accessor: action_process_image_command_line
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: XQLPossibleMaliciousCmd.results.actor_process_command_line
                iscontext: true
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
          - operator: uniq
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 2690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "135":
    id: "135"
    taskid: 70302ae0-bf20-4e5a-810f-4a922f17ba6c
    type: title
    task:
      id: 70302ae0-bf20-4e5a-810f-4a922f17ba6c
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "75"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "138":
    id: "138"
    taskid: fb26190e-92c5-4598-88ec-ff48b828affb
    type: condition
    task:
      id: fb26190e-92c5-4598-88ec-ff48b828affb
      version: -1
      name: Found any suspicious command lines?
      description: Checks if any suspicious command lines were found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "68"
      "yes":
      - "134"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: XQLPossibleMaliciousCmd.results.actor_process_command_line
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              simple: XQLPossibleMaliciousCmd.results.action_process_image_command_line
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 2530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "145":
    id: "145"
    taskid: 397694d2-d08b-4dac-86fe-83e2731b3092
    type: condition
    task:
      id: 397694d2-d08b-4dac-86fe-83e2731b3092
      version: -1
      name: Found any malicious command lines?
      description: Checks if any malicious command lines were found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "68"
      "yes":
      - "94"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: CommandLineAnalysis.analysis.original.indicators.URL
            iscontext: true
          right:
            value:
              simple: ExtractedIndicators.URL
            iscontext: true
        - operator: greaterThan
          left:
            value:
              simple: CommandLineAnalysis.score
            iscontext: true
          right:
            value:
              simple: "50"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "150":
    id: "150"
    taskid: 89f291f4-dcc5-42a0-8f12-cffa37a7aab8
    type: condition
    task:
      id: 89f291f4-dcc5-42a0-8f12-cffa37a7aab8
      version: -1
      name: ' Are there any suspicious findings?'
      description: Check if there are any suspicious findings collected during the investigation
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "151"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: CompromisedHostDetected
            iscontext: true
          right:
            value: {}
        - operator: isEqualString
          left:
            value:
              simple: alert.name
            iscontext: true
          right:
            value:
              simple: CVE Exploitation - 2037164431
        - operator: isEqualString
          left:
            value:
              simple: alert.name
            iscontext: true
          right:
            value:
              simple: CVE Exploitation - 3823999562
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3743.5,
          "y": 4484
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "151":
    id: "151"
    taskid: efc10d3f-4e8a-48a2-841a-d31d2c893173
    type: collection
    task:
      id: efc10d3f-4e8a-48a2-841a-d31d2c893173
      version: -1
      name: Analyst approval required for isolation
      description: |-
        As part of the playbook, we have identified possible malicious activity related to the vulnerability CVE-2025-59287. Therefore, we strongly suggest reviewing the finding:

        ### Malicious command lines
        The list below (if there are any findings, otherwise this section remains empty):

        ```${MaliciousCommandLinesDetected(val.length > 0) =>"- " + val.join("\n - ")}```

        **Recommended action: Isolate vulnerable servers until patching is complete.**
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "157"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3950,
          "y": 4660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: 'Select hosts to isolate from the following agent IDs:'
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - {}
        - complex:
            root: CompromisedHostDetected
            transformers:
            - operator: AppendIfNotEmpty
              args:
                item:
                  value:
                    simple: alert.agentid
                  iscontext: true
                raw: {}
            - operator: uniq
        - simple: No Action
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Hosts to isolate
      description: |-
        The following hosts were identified as WSUS servers that were exploited and compromised via vulnerability CVE-2025-59287.
        It is recommended to isolate them until patching is complete.
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "156":
    id: "156"
    taskid: b26d8f77-0bbb-403c-86f0-b7f429acb8c5
    type: regular
    task:
      id: b26d8f77-0bbb-403c-86f0-b7f429acb8c5
      version: -1
      name: Isolate Endpoint
      description: This script isolates endpoints using multiple integrations and returns a success or failure message.
      scriptName: isolate-endpoint
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "160"
    scriptarguments:
      brands:
        simple: Cortex Core - IR
      endpoint_id:
        simple: ${Hosts to isolate.Answers.0}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3950,
          "y": 5000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "157":
    id: "157"
    taskid: 767264df-ae80-4034-82db-ce31a345c3a6
    type: condition
    task:
      id: 767264df-ae80-4034-82db-ce31a345c3a6
      version: -1
      name: Are there any hosts to isolate based on analyst approval?
      description: Check the analyst’s answer.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "156"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: notContainsGeneral
          left:
            value:
              simple: Hosts to isolate.Answers.0
            iscontext: true
          right:
            value:
              simple: No Action
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3950,
          "y": 4805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "159":
    id: "159"
    taskid: a292f79e-b8ef-409b-8b88-4a72014a058d
    type: regular
    task:
      id: a292f79e-b8ef-409b-8b88-4a72014a058d
      version: -1
      name: Manual remediation actions for a server or a disconnected endpoint
      description: "Dear Analyst,\n\nPlease note that during the remediation process, the playbook didn't isolate the following host: ${alert.hostname} \n\nThis is due to one of the following reasons:\n- The device disconnected.\n\nPlease take manual action to contain the attack and prevent the attacker from executing lateral movement before closing this alert."
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4080,
          "y": 5306.66650390625
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "160":
    id: "160"
    taskid: 66b60b38-17dd-4c18-895b-8687466d68ea
    type: condition
    task:
      id: 66b60b38-17dd-4c18-895b-8687466d68ea
      version: -1
      name: Was the endpoint isolation successful?
      description: Verifies whether the endpoint isolation was successful.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "159"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: IsolateEndpoint.Result
            iscontext: true
          right:
            value:
              simple: Success
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3950,
          "y": 5150.66650390625
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "161":
    id: "161"
    taskid: 6b55b744-d879-417a-80c9-f760aa842106
    type: regular
    task:
      id: 6b55b744-d879-417a-80c9-f760aa842106
      version: -1
      name: Set original malicious command lines
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "162"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MaliciousCommandLinesDetected
      value:
        complex:
          root: CommandLineAnalysis
          filters:
          - - operator: greaterThan
              left:
                value:
                  simple: CommandLineAnalysis.score
                iscontext: true
              right:
                value:
                  simple: "50"
            - operator: containsGeneral
              left:
                value:
                  simple: CommandLineAnalysis.analysis.original.indicators.URL
                iscontext: true
              right:
                value:
                  simple: ExtractedIndicators.URL
                iscontext: true
              ignorecase: true
          accessor: original_command
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 3160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "162":
    id: "162"
    taskid: e6e18d8f-799f-4bbd-8f90-4aac07e07ef9
    type: regular
    task:
      id: e6e18d8f-799f-4bbd-8f90-4aac07e07ef9
      version: -1
      name: Set compromised WSUS servers
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: CompromisedHostDetected
      value:
        complex:
          root: XQLPossibleMaliciousCmd.results
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: XQLPossibleMaliciousCmd.results.actor_process_command_line
                iscontext: true
              right:
                value:
                  simple: MaliciousCommandLinesDetected
                iscontext: true
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: XQLPossibleMaliciousCmd.results.action_process_image_command_line
                iscontext: true
              right:
                value:
                  simple: MaliciousCommandLinesDetected
                iscontext: true
          accessor: agent_id
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: alert.agentid
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4201.5,
          "y": 3325
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "163":
    id: "163"
    taskid: fb113467-9475-476d-84cc-546948b02e23
    type: playbook
    task:
      id: fb113467-9475-476d-84cc-546948b02e23
      version: -1
      name: Block Indicators - Generic v3
      description: |-
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2.
      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      AutoBlockIndicators:
        simple: "True"
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: domain
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "2"
          accessor: Indicator
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
          - operator: uniq
      IP:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "2"
          accessor: Indicator
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.IP
                iscontext: true
          - operator: uniq
      InputEnrichment:
        simple: "False"
      InternalRange:
        complex:
          root: lists
          accessor: PrivateIPs
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
              unpack_matches: {}
          - operator: join
            args:
              separator:
                value:
                  simple: ','
      MD5:
        complex:
          root: DBotScore
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: "32"
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
            - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: hash
          accessor: Indicator
          transformers:
          - operator: uniq
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      SHA256:
        complex:
          root: DBotScore
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: "64"
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
            - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: hash
          accessor: Indicator
          transformers:
          - operator: uniq
      Tag:
        simple: Blocked Indicator In Systems
      URL:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "2"
          accessor: Indicator
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.URL
                iscontext: true
          - operator: uniq
      UserVerification:
        simple: "False"
      Username:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: username
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 3180,
          "y": 4484
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "108_121_#error#": 0.4,
      "109_108_yes": 0.36,
      "109_121_#default#": 0.42,
      "110_113_yes": 0.5,
      "110_28_#default#": 0.13,
      "138_134_yes": 0.44,
      "138_68_#default#": 0.44,
      "145_68_#default#": 0.46,
      "150_31_#default#": 0.18,
      "157_31_#default#": 0.42,
      "160_31_yes": 0.3,
      "1_2_#error#": 0.48,
      "4_9_#default#": 0.12,
      "72_68_#default#": 0.38,
      "74_79_#error#": 0.31,
      "75_74_yes": 0.36,
      "75_79_#default#": 0.45,
      "99_38_#default#": 0.3
    },
    "paper": {
      "dimensions": {
        "height": 6985,
        "width": 1835,
        "x": 3150,
        "y": -537
      }
    }
  }
inputs: []
inputSections:
- inputs: []
  name: General (Inputs group)
  description: Generic group for inputs
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0