KQL Search

// Device or VM with critical CVSS and ExploitIsVerified 
// https://www.linkedin.com/posts/activity-7193835506164469761-_1ty/

// The ‘MDE DeviceTvmSoftwareVulnerabilitiesKB’ table includes the ‘IsExploitAvailable’ column, which simply indicates the public availability of an exploit. In contrast, the ‘Exposure Management ExposureGraphNodes’ table features the ‘ExploitabilityLevel’ column, offering more detailed information about the exploit, such as whether ‘ExploitIsVerified’. Bearing this in mind, we have crafted a KQL query to isolate Critical CVEs that are verified as exploitable. This query is then combined with the ‘ExposureGraphEdge’ to identify all devices and virtual machines that are vulnerable to critical, exploitable CVEs. The goal is to prioritize the remediation of these machines urgently, thereby minimizing the potential attack surface.

ExposureGraphNodes 
| where NodeLabel == "Cve"
| extend CVSSScore = tostring(NodeProperties.rawData.cvssScore)
| extend Severity = tostring(NodeProperties.rawData.severity)
| extend HasExploit = tostring(NodeProperties.rawData.hasExploit)
| extend ExploitabilityLevel = tostring(NodeProperties.rawData.exploitabilityLevel)
| where ExploitabilityLevel == "ExploitIsVerified" and Severity == "Critical"
| join ExposureGraphEdges on $left.NodeId == $right.SourceNodeId
| project TargetNodeName, TargetNodeLabel, SourceNodeName, CVSSScore, NodeProperties
| sort by CVSSScore desc