Vuln Internetexposeddevices

KQL detection rule by reprise99 · MIT

Use logon and network telemetry to find machines exposed to the internet, then count the critical and high severity vulnerabilities on those devices This query only works in Advanced Hunting as the DeviceTvm* tables aren't sent to Sentinel yet

//Use logon and network telemetry to find machines exposed to the internet, then count the critical and high severity vulnerabilities on those devices
//This query only works in Advanced Hunting as the DeviceTvm* tables aren't sent to Sentinel yet

//Data connector required for this query - Advanced Hunting license

//Look for logon events coming from a public IP - query adapted from https://github.com/alexverboon/MDATP/blob/master/AdvancedHunting/Failed%20Logon%20-%20Public%20IP.md
let publicips = 
    DeviceLogonEvents
    | where Timestamp > ago(30d)
    | where ActionType in ("LogonFailed", "LogonSuccess")
    | where RemoteIPType == "Public"
    | distinct RemoteIP;
//Use that same list of IP addresses to search for network traffic coming from those IP's, suggesting the device is available on the internet
let publicdevices=
    DeviceNetworkEvents
    | where Timestamp > ago (30d)
    | where RemoteIPType == "Public"
    | where RemoteIP in (publicips)
    | distinct DeviceName;
//Find the high and critical vulnerability count for those devices
DeviceTvmSoftwareVulnerabilities
| where DeviceName in (publicdevices)
| summarize ['Vulnerability Count']=dcountif(CveId, VulnerabilitySeverityLevel in ("Critical", "High")) by DeviceName
| sort by ['Vulnerability Count'] desc

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4ccd6da0-ff20-4efb-82fc-634acc661c49

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion