KQL Search

// CVE-2024-38063 CVSS 9.8 Prioritization
// Linkedin Post: https://www.linkedin.com/posts/0x534c_defenderxdr-exposuremanagement-mde-activity-7229516269274685443-fTwM/
// An attacker can remotely exploit this vulnerability by sending specially crafted IPv6 packets to a target host. No user interaction is needed, making it a ‘0-click’ vulnerability. Only IPv6 packets can be used to exploit this critical vulnerability.

// It is important to identify privileged admin endpoints that are running IPv6 and are internet-facing. Prioritizing the patching of these endpoints is crucial, as they hold the keys to your systems.

// Using DefenderXDR Exposure Management and Microsoft Defender for Endpoint schema information, we are able to determine these important group of endpoints to be prioritize for patching.

let CriticalIdentities =
ExposureGraphNodes
| where set_has_element(Categories, "identity")
| where isnotnull(NodeProperties.rawData.criticalityLevel) and
NodeProperties.rawData.criticalityLevel.criticalityLevel < 4 
| distinct NodeName;
let CriticalDevices =
ExposureGraphEdges 
| where EdgeLabel == @"can authenticate to"
| join ExposureGraphNodes on $left.TargetNodeId==$right.NodeId
| extend DName = tostring(NodeProperties.rawData.deviceName)
| extend isLocalAdmin = EdgeProperties.rawData.userRightsOnDevice.isLocalAdmin
| where SourceNodeName has_any (CriticalIdentities)
| distinct DName;
let VulnerableCriticalDevices =
DeviceTvmSoftwareVulnerabilities 
| where CveId == "CVE-2024-38063"
| where DeviceName has_any (CriticalDevices)
| distinct DeviceName;
DeviceNetworkInfo
| where Timestamp > ago(30d)
| mv-expand todynamic(IPAddresses)
| extend IP = tostring(IPAddresses.IPAddress)
| where IPAddresses has "Public" and IP contains ":" // IPv6 Public Facing
| where DeviceName has_any(VulnerableCriticalDevices) // Critical Devices

// MSRC Security Updates (CVE-2024-38063)
// Link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063

// #DefenderXDR #ExposureManagement #MDE #IPv6 #CriticalVulnerability 

// MITRE ATT&CK Mapping

// T1078: Valid Accounts - Identifying critical accounts that could be targeted.
// T1078: Valid Accounts - Identifying devices that can be accessed using valid accounts.
// T1078.003: Local Accounts - Identifying local admin accounts on devices.
// T1190: Exploit Public-Facing Application - Identifying devices vulnerable to exploitation.
// T1049: System Network Connections Discovery - Identifying network connections.
// T1016: System Network Configuration Discovery - Identifying network configurations.

// This KQL query sequence is designed to identify critical identities and devices, determine their vulnerabilities, and find public-facing IPv6
// addresses. The associated MITRE ATT&CK techniques include Valid Accounts, Exploit Public-Facing Application, System Network Connections
// Discovery, and System Network Configuration Discovery.