Device Vulnerability Software Evidence Details

Query

let VulnDevice = "YOURSERVERNAME";
let DeviceScope =
	DeviceInfo
	| where DeviceName startswith VulnDevice or DeviceId =~ VulnDevice
	| summarize arg_max(Timestamp, *) by DeviceId
	| project DeviceId, DeviceName;
let Vulns =
	DeviceTvmSoftwareVulnerabilities
	| join kind=inner DeviceScope on DeviceId;
let Evidence =
	DeviceTvmSoftwareEvidenceBeta
	| join kind=inner DeviceScope on DeviceId
	| project
		DeviceId,
		SoftwareName,
		SoftwareVendor,
		SoftwareVersion,
		DiskPaths,
		RegistryPaths;
Vulns
| join kind=leftouter Evidence on DeviceId, SoftwareName, SoftwareVendor, SoftwareVersion
| extend
	FilePaths = iff(isnotempty(DiskPaths), tostring(DiskPaths), "[]"),
	RegPaths = iff(isnotempty(RegistryPaths), tostring(RegistryPaths), "[]")
| project
	DeviceName,
	CveId,
	VulnerabilitySeverityLevel,
	SoftwareName,
	SoftwareVendor,
	SoftwareVersion,
	RecommendedSecurityUpdate,
	RecommendedSecurityUpdateId,
	FilePaths,
	RegPaths
| order by VulnerabilitySeverityLevel desc, CveId asc

About this query

Device Vulnerability & Software Evidence Details

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link

Description

Retrieves all software vulnerabilities for a specific device, enriched with underlying detection evidence. It correlates vulnerability data with file paths (DiskPaths) or registry entries (RegistryPaths), making it easy to identify the exact location or reason for each vulnerability finding.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

References

Defender XDR

Explanation

This KQL (Kusto Query Language) query is designed to retrieve and display software vulnerabilities for a specific device, along with detailed evidence of where these vulnerabilities are located. Here's a simplified breakdown of what the query does:

Device Identification: It starts by identifying the device of interest using a placeholder name "YOURSERVERNAME". This is done by checking if the device name or ID matches the specified name.
Vulnerability Data: It collects data on software vulnerabilities associated with the identified device. This includes information like the severity level of each vulnerability and recommended security updates.
Evidence Collection: It gathers evidence related to these vulnerabilities, such as file paths (DiskPaths) and registry paths (RegistryPaths), which help pinpoint the exact location or reason for each vulnerability.
Data Correlation: The query correlates the vulnerability data with the evidence data, ensuring that each vulnerability is linked to its corresponding file or registry path.
Output: The final output includes details like the device name, CVE ID (Common Vulnerabilities and Exposures identifier), severity level, software details, recommended updates, and the file or registry paths associated with each vulnerability. The results are ordered by severity level (from highest to lowest) and then by CVE ID.

Overall, this query helps security analysts quickly identify and understand software vulnerabilities on a specific device, along with the evidence needed to address them.