{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "MuddyWater's move to custom implants like MuddyRot bypasses standard RMM-based detections. This hunt provides a negative result over the estate for this emerging Iranian tradecraft."
      },
      "name": "MuddyRot Custom Implant Lifecycle",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1566",
        "attack.t1053.005",
        "attack.t1059.003",
        "attack.t1041",
        "attack.t1090.003"
      ],
      "related": [
        {
          "hunt": "atera-rmm-abuse-detection",
          "reason": "The report notes MuddyWater is replacing Atera, but older or concurrent campaigns may still use the RMM tool.",
          "relation": "alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This phased hunt connects unpatched server vulnerabilities to specific host and network indicators that would be too noisy as standalone rules. By pivoting from a baseline of rare ProgramData binaries to specific C2 IPs, it provides the context an analyst needs to confirm an intrusion rather than an isolated tool detection.",
      "coverage": [
        {
          "stage": "initial-access-delivery",
          "steps": [
            "vulnerable-server-scope"
          ],
          "status": "covered"
        },
        {
          "stage": "muddyrot-persistence-installation",
          "steps": [
            "detect-implant-file",
            "detect-scheduled-task"
          ],
          "status": "covered"
        },
        {
          "stage": "command-and-control-raw-tcp",
          "steps": [
            "c2-network-traffic"
          ],
          "status": "covered"
        },
        {
          "stage": "interactive-shell-and-file-ops",
          "steps": [
            "rare-programdata-binaries",
            "reverse-shell-execution"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Spearphishing or Application Exploitation",
            "slug": "initial-access-delivery",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1190"
            ],
            "observables": [
              "PDF files with Egnyte links",
              "Exploitation of Exchange or SharePoint servers",
              "Downloads from egnyte.com"
            ]
          },
          {
            "name": "MuddyRot Deployment and Persistence",
            "slug": "muddyrot-persistence-installation",
            "tactic": "persistence",
            "techniques": [
              "T1053.005",
              "T1059"
            ],
            "observables": [
              "C:\\ProgramData\\softwarememory\\documentsmanagerreporter.exe",
              "Scheduled Task named DocumentsManagerReporter",
              "COM CLSID 0F87369F-A4E5-4CFC-BD3E-73E6154572DD",
              "Mutex named DocumentUpdater"
            ]
          },
          {
            "name": "C2 Fingerprinting and Communication",
            "slug": "command-and-control-raw-tcp",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003",
              "T1041"
            ],
            "observables": [
              "TCP port 443",
              "91.235.234.202",
              "146.19.143.14",
              "Hostname/username string fingerprinting"
            ]
          },
          {
            "name": "Reverse Shell and File Operations",
            "slug": "interactive-shell-and-file-ops",
            "tactic": "execution",
            "techniques": [
              "T1059.003"
            ],
            "observables": [
              "cmd.exe spawned with anonymous pipes",
              "Buffer file named 'exit' in working directory",
              "Command IDs 0x1 (Upload), 0x2 (Download), 0x3 (Reverse Shell)"
            ]
          }
        ],
        "summary": "MuddyWater transitioned from leveraging legitimate RMM tools to a custom C-based implant called MuddyRot, delivered via phishing PDFs with Egnyte links or server exploitation. The implant establishes persistence via scheduled tasks using COM objects and provides reverse shell and file transfer capabilities over raw TCP port 443."
      },
      "severity": "high",
      "rationale": "Prioritize Exchange and SharePoint servers identified in the vulnerability scoping step. MuddyWater uses these servers as beachheads before establishing persistent implants in ProgramData.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder has deployed the MuddyRot implant on a public-facing server, establishing persistence via a custom scheduled task and initiating a reverse shell to known Iranian C2 infrastructure.",
      "parameters": {
        "c2_ips": {
          "from": {
            "ref": "https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/",
            "kind": "article",
            "observed": "2024-06-20"
          },
          "type": "list[ip]",
          "default": [
            "91.235.234.202",
            "146.19.143.14"
          ],
          "description": "Known MuddyRot C2 infrastructure IPs."
        },
        "task_name": {
          "from": {
            "ref": "https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/",
            "kind": "article",
            "observed": "2024-06-20"
          },
          "type": "string",
          "default": "DocumentsManagerReporter",
          "description": "Name of the persistence scheduled task."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hostnames of vulnerable servers found in the scoping step; leave empty to hunt across the full estate."
        },
        "implant_path": {
          "from": {
            "ref": "https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/",
            "kind": "article",
            "observed": "2024-06-20"
          },
          "type": "path",
          "default": "C:\\ProgramData\\softwarememory\\documentsmanagerreporter.exe",
          "description": "Target installation path for the MuddyRot implant."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/",
          "name": "Sekoia TDR \u2014 MuddyWater replaces Atera with custom MuddyRot implant"
        }
      ],
      "blind_spots": [
        {
          "id": "com-task-registration-blind-spot",
          "risk": "The hunt may not see the registration event if it bypasses the schtasks.exe utility, relying instead on the visibility of the job store.",
          "stage": "muddyrot-persistence-installation",
          "question": "Was the scheduled task registered via COM rather than schtasks.exe?",
          "requires": "COM object invocation logging"
        },
        {
          "id": "c2-obfuscated-payloads",
          "risk": "MuddyRot obfuscates its C2 traffic using a byte subtraction; raw network logs will show the traffic volume but not the operator's intent.",
          "stage": "command-and-control-raw-tcp",
          "question": "What specific commands were sent to the reverse shell?",
          "requires": "Network payload decryption"
        }
      ]
    },
    "name": "MuddyRot Custom Implant Lifecycle",
    "description": "MuddyWater (MOIS) has transitioned from legitimate RMM tools like Atera to a custom C-based implant named MuddyRot. This hunt identifies the implant across its lifecycle: from the presence of unpatched vulnerabilities to the installation of its documentsmanagerreporter.exe binary in ProgramData, its scheduled task persistence, and finally its raw TCP C2 communication and interactive reverse shell behavior. The hunt follows a phased flow to build confidence from installation to active exploitation."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-delivery",
            "steps": [
              "vulnerable-server-scope"
            ],
            "status": "covered"
          },
          {
            "stage": "muddyrot-persistence-installation",
            "steps": [
              "detect-implant-file",
              "detect-scheduled-task"
            ],
            "status": "covered"
          },
          {
            "stage": "command-and-control-raw-tcp",
            "steps": [
              "c2-network-traffic"
            ],
            "status": "covered"
          },
          {
            "stage": "interactive-shell-and-file-ops",
            "steps": [
              "rare-programdata-binaries",
              "reverse-shell-execution"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An intruder has deployed the MuddyRot implant on a public-facing server, establishing persistence via a custom scheduled task and initiating a reverse shell to known Iranian C2 infrastructure.",
        "blind_spots": [
          {
            "id": "com-task-registration-blind-spot",
            "risk": "The hunt may not see the registration event if it bypasses the schtasks.exe utility, relying instead on the visibility of the job store.",
            "stage": "muddyrot-persistence-installation",
            "question": "Was the scheduled task registered via COM rather than schtasks.exe?",
            "requires": "COM object invocation logging"
          },
          {
            "id": "c2-obfuscated-payloads",
            "risk": "MuddyRot obfuscates its C2 traffic using a byte subtraction; raw network logs will show the traffic volume but not the operator's intent.",
            "stage": "command-and-control-raw-tcp",
            "question": "What specific commands were sent to the reverse shell?",
            "requires": "Network payload decryption"
          }
        ],
        "scoping_notes": "Prioritize Exchange and SharePoint servers identified in the vulnerability scoping step. MuddyWater uses these servers as beachheads before establishing persistent implants in ProgramData.",
        "beyond_detection": "This phased hunt connects unpatched server vulnerabilities to specific host and network indicators that would be too noisy as standalone rules. By pivoting from a baseline of rare ProgramData binaries to specific C2 IPs, it provides the context an analyst needs to confirm an intrusion rather than an isolated tool detection."
      }
    },
    {
      "id": "vulnerable-server-scope",
      "type": "query",
      "label": "Scope vulnerable public-facing servers",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, affected_package_name, affected_package_version, title, severity FROM hb_vulnerability_finding WHERE (LOWER(title) LIKE '%exchange%' OR LOWER(title) LIKE '%sharepoint%') AND status != 'suppressed' AND severity_id >= 4",
        "surface": "hb_vulnerability_finding",
        "description": "Identify servers with unpatched vulnerabilities in Exchange or SharePoint, which are primary targets for MuddyWater initial access.",
        "expected_signal": "A list of high-severity vulnerabilities on servers. Silence means no such vulnerabilities are currently known."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope vulnerable public-facing servers",
        "reads": [
          "affected_package_name",
          "affected_package_version",
          "device_uid",
          "severity",
          "severity_id",
          "status",
          "title"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, affected_package_name, affected_package_version, title, severity FROM hb_vulnerability_finding WHERE (LOWER(title) LIKE '%exchange%' OR LOWER(title) LIKE '%sharepoint%') AND status != 'suppressed' AND severity_id >= 4",
        "silence": "not_evidence_of_absence",
        "expected": "A list of high-severity vulnerabilities on servers. Silence means no such vulnerabilities are currently known.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "detect-implant-file",
      "type": "query",
      "label": "MuddyRot binary drop in ProgramData",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE LOWER(file_path) = LOWER('{{implant_path}}') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Detect the creation of the MuddyRot binary in the specific softwarememory directory.",
        "expected_signal": "A high-fidelity hit for the documentsmanagerreporter.exe file creation on a server."
      },
      "parents": [
        {
          "id": "vulnerable-server-scope"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "MuddyRot binary drop in ProgramData",
        "reads": [
          "device_hostname",
          "file_path",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE LOWER(file_path) = LOWER('{{implant_path}}') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A high-fidelity hit for the documentsmanagerreporter.exe file creation on a server.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "detect-scheduled-task",
      "type": "query",
      "label": "Implant scheduled task persistence",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, job_name, job_cmd_line, time FROM hb_scheduled_job WHERE LOWER(job_name) = LOWER('{{task_name}}') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_scheduled_job",
        "description": "Find the scheduled task used to ensure the implant survives reboots.",
        "expected_signal": "A task named DocumentsManagerReporter pointing to the implant binary."
      },
      "parents": [
        {
          "id": "vulnerable-server-scope"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Implant scheduled task persistence",
        "reads": [
          "device_hostname",
          "job_cmd_line",
          "job_name",
          "time"
        ],
        "source": "hb_scheduled_job",
        "target": "endpoint",
        "content": "SELECT device_hostname, job_name, job_cmd_line, time FROM hb_scheduled_job WHERE LOWER(job_name) = LOWER('{{task_name}}') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A task named DocumentsManagerReporter pointing to the implant binary.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Triage early-stage indicators",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "vulnerable-server-scope",
          "detect-implant-file",
          "detect-scheduled-task"
        ],
        "objective": "Determine if the file and task artifacts indicate a successful MuddyRot deployment on any high-risk host.",
        "description": "Correlate scoping results with the installation artifacts to identify compromised beachhead hosts.",
        "max_iterations": 6,
        "expected_signal": "Confirmation of MuddyRot persistence on a server.",
        "success_criteria": "A verdict of 'compromised' for any host with matching installation signals."
      },
      "parents": [
        {
          "id": "detect-implant-file",
          "kind": "merge"
        },
        {
          "id": "detect-scheduled-task",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "c2-network-traffic",
      "type": "query",
      "label": "C2 traffic to MuddyWater IPs",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Detect raw TCP connections to the specific Iranian IPs associated with MuddyRot campaigns.",
        "expected_signal": "Network connections from the implant host to known C2 servers on port 443."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "C2 traffic to MuddyWater IPs",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "process_name",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Network connections from the implant host to known C2 servers on port 443.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-programdata-binaries",
      "type": "query",
      "label": "Rare binaries in ProgramData",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) LIKE 'c:\\programdata\\%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3 ORDER BY host_count ASC",
        "surface": "hb_process_activity",
        "description": "Stack-count binaries in ProgramData to highlight unique implants like MuddyRot that do not appear across the rest of the fleet.",
        "expected_signal": "The MuddyRot binary should appear as a rare path (host_count = 1)."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare binaries in ProgramData",
        "reads": [
          "device_hostname",
          "process_path",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) LIKE 'c:\\programdata\\%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "The MuddyRot binary should appear as a rare path (host_count = 1).",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "reverse-shell-execution",
      "type": "query",
      "label": "Reverse shell cmd.exe activity",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) = LOWER('{{implant_path}}') AND LOWER(process_name) LIKE '%cmd.exe' AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify cmd.exe instances spawned by the implant path, signifying interactive operator activity.",
        "expected_signal": "Process events where the implant binary is the parent of a command shell."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Reverse shell cmd.exe activity",
        "reads": [
          "device_hostname",
          "parent_process_name",
          "process_cmd_line",
          "process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) = LOWER('{{implant_path}}') AND LOWER(process_name) LIKE '%cmd.exe' AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Process events where the implant binary is the parent of a command shell.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "follow-on-triage",
      "type": "analytic",
      "label": "Correlate full lifecycle",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "early-stage-triage",
          "c2-network-traffic",
          "rare-programdata-binaries",
          "reverse-shell-execution"
        ],
        "objective": "Integrate the early-stage compromise verdict with current C2 and shell evidence to determine if the intrusion is active.",
        "description": "Combine installation evidence with execution and C2 activity to confirm a live intrusion.",
        "max_iterations": 6,
        "expected_signal": "A definitive verdict citing host vulnerability, persistence, and C2 activity.",
        "success_criteria": "A verdict of 'malicious' for hosts where the full chain is observed."
      },
      "parents": [
        {
          "id": "c2-network-traffic",
          "kind": "merge"
        },
        {
          "id": "rare-programdata-binaries",
          "kind": "merge"
        },
        {
          "id": "reverse-shell-execution",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the follow-on-triage verdict is malicious for at least one host",
        "condition": "the follow-on-triage verdict is malicious for at least one host",
        "blind_spot": "com-task-registration-blind-spot",
        "confidence": "high",
        "description": "Route to remediation if an active intrusion is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-triage"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Stop C2 communication and prevent lateral movement while investigation continues.",
        "instructions": "Isolate the host, terminate the documentsmanagerreporter.exe process, and delete the DocumentsManagerReporter scheduled task.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Detailed analyst investigation",
      "config": {
        "assignee": "analyst",
        "description": "Conduct follow-on IR to check for lateral movement or secondary payloads like SimpleHelp.",
        "instructions": "Examine process activity around the time of the reverse shell; look for secondary tools MuddyWater often deploys like SharpTypo or remote management software."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close-out",
      "config": {
        "assignee": "analyst",
        "description": "Record findings and document the estate's exposure.",
        "instructions": "If no malicious activity was found, record the hosts examined and note that no MuddyRot artifacts were visible within the lookback window."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}