KQL Search

// CVE-2024-7971 Patch Prioritization

//Google has addressed a high-severity Chrome vulnerability that is currently being actively exploited. It’s crucial to identify which of your global administrators are using a vulnerable version of Chrome, especially if their credential cookies are stored on their endpoints. Given that threat actors are exploiting this flaw, it’s strongly recommended to patch the global admin endpoints immediately to significantly reduce the attack surface.

let CriticalIdentities =
ExposureGraphNodes
| where set_has_element(Categories, "identity")
| where isnotnull(NodeProperties.rawData.criticalityLevel) 
and NodeProperties.rawData.criticalityLevel.criticalityLevel < 4
| where NodeProperties has "Global Administrator"
| distinct NodeName;
let VulnerableEndPointwithBCookie =
ExposureGraphEdges
| where EdgeLabel == @"has credentials of"
| where EdgeProperties has "BrowserCookies"
| where TargetNodeName has_any (CriticalIdentities)
| distinct SourceNodeName;
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2024-7971"
| where DeviceName has_any (VulnerableEndPointwithBCookie)