KQL Search

# *High-Risk Vulnerabilities with Exploits Detected on Onboarded Devices*

## Query Information

### Category: Threat Hunting 

#### MITRE ATT&CK Technique(s)

| Technique ID | Title    | Link    |
| ---  | --- | --- |
| T1068 | Exploitation for Privilege Escalation | https://attack.mitre.org/techniques/T1068 |
| T1203 | Exploitation for Client Execution | https://attack.mitre.org/techniques/T1203 |


#### Description

This Threat Hunting Query identifies onboarded devices that have high-risk vulnerabilities (CVSS score > 9) for Remote Code Execution (RCE) or Privilege Escalation (PrivEsc) where public exploits are known to exist or have been verified. It leverages Exposure Graph data to pinpoint critical security exposures on devices within the environment.

the typo in the Query has to be there, as long MSFT will not fix it in the ExposureGraphNodes table

<img width="410" height="35" alt="image" src="https://github.com/user-attachments/assets/c83dad53-45b9-4fbb-a575-2a24e7462e17" />


#### Author <Optional>
- **Name: Benjamin Zulliger**
- **Github: https://github.com/benscha/KQLAdvancedHunting**
- **LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/**

## Defender XDR
```KQL
// Threat Hunting Query
ExposureGraphNodes
| where NodeLabel == "device"
| extend RawDataDynamic = NodeProperties.rawData
| project-away NodeProperties
| evaluate bag_unpack(RawDataDynamic)
| where onboardingStatus == "Onboarded"
| extend RCE = parse_json(highRiskVulnerabilityInsights.vulnerableToRemoteCodeExecution)
| extend PrivEsc = parse_json(highRiskVulnerabilityInsights.vulnerableToPrivilegeEscalation)
| where RCE.explotabilityLevels has "ExploitIsPublic"
	or RCE.explotabilityLevels has "ExploitIsVerified"
    or PrivEsc.explotabilityLevels has "ExploitIsPublic"
    or PrivEsc.explotabilityLevels has "ExploitIsVerified"
| where RCE.maxCvssScore >9 or PrivEsc.maxCvssScore >9
| project deviceName, azureADJoinType, exposureScore, isCustomerFacing, isExcluded, isHybridAzureADJoined, lastSeen, osPlatformFriendlyName, osVersionFriendlyName, RCE, PrivEsc

```