KQL Search

// CVE-2024-10443 Hunting: RISK:STATION

// Synology has addressed a critical security flaw impacting DiskStation and BeePhotos that could lead to remote code execution. RISK:STATION is an unauthenticated zero-click vulnerability allowing attackers to obtain root-level code execution on the popular Synology DiskStation and BeeStation NAS devices, affecting millions of devices.

// Do you know where all your corporate Synology NAS boxes are? The following Sentinel KQL will scan through your DeviceNetworkEvents table for the past 90 days and prepare a list of Synology NAS quick connect hosts and your Microsoft Defender for Endpoints connection. This allows SecOps to work with Infra Ops to ensure all NAS boxes are patched.

// Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices
// Link: https://thehackernews.com/2024/11/synology-urges-patch-for-critical-zero.html

DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where ActionType == @"HttpConnectionInspected"
| extend Host = tostring(parse_json(AdditionalFields)["host"])
| where Host contains ":5001" // Synology DSM secure port
| distinct Host, DeviceName
| sort by Host desc