KQL Search

// Infrastructure Vulnerability Exposure to Volt Typhoon

// Expert analysis from last year revealed that PRC APT groups, such as Volt Typhoon, frequently exploit known vulnerabilities in TP-Link routers during their malicious campaigns. These campaigns have included targeting government officials in European countries. In these attacks, modified firmware images have so far been found exclusively on TP-Link routers.
// Given the portability of user laptops, there is a risk that a laptop used for work might connect to a TP-Link wireless router at home, in a café, or at another mobile working location. This connection increases the security risk for both the endpoint and the TP-Link router, potentially making them vulnerable to exploitation.
// By leveraging Microsoft’s endpoint discovery capabilities, you can identify if any of your endpoints have connected to or detected a TP-Link router. Additionally, correlating the vulnerabilities present on these endpoints can help estimate the exposure risk to APT groups exploiting TP-Link routers.

// The below KQL query will provide you a summary of your total endpoints vulnerabilities count (High, Medium & Low) that are exposed to a TP-Link router environment.

let DeviceExposedToTPLinkRouter =
DeviceInfo
| summarize arg_max(Timestamp, *) by DeviceId
| where isempty(MergedToDeviceId)
| where OnboardingStatus != "Onboarded"
| where Vendor contains "TP-LINK"
| invoke SeenBy()
| extend parsedJson = parse_json(SeenBy)
| extend SeenByDeviceID = tostring(parsedJson[0].DeviceId)
| project SeenByDeviceID;
DeviceTvmSoftwareVulnerabilities
| where DeviceId has_any(DeviceExposedToTPLinkRouter)
| summarize VulnerabilityCount=count() by VulnerabilitySeverityLevel