Defender-DeviceTvmSoftwareVulnerabilities
any: Software vulnerabilities on devices
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
DeviceId | 1 detection rule | Kusto |
VulnerabilitySeverityLevel | 1 detection rule | Kusto |
Representative record #
{
"AadDeviceId": "db412646-80ba-4176-935f-7450b35979ee",
"CveId": "CVE-2026-48092",
"CveTags@odata.type": "#Collection(String)",
"DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
"DeviceName": "jd-win11-22h2-1.ludus.domain",
"OSArchitecture": "x64",
"OSPlatform": "Windows11",
"OSVersion": "10.0.22621.6060",
"SoftwareName": "7-zip",
"SoftwareVendor": "7-zip",
"SoftwareVersion": "25.01.0.0",
"VulnerabilitySeverityLevel": "Medium"
}
Detection Patterns #
Initial Access: Exploit Public-Facing Application
Defender-DeviceNetworkEvents InboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceTvmSoftwareVulnerabilities any: Software vulnerabilities on devicesORDefender-DeviceTvmSoftwareVulnerabilitiesKB any: Vulnerability knowledge baseORDefender-ExposureGraphNodes any: Exposure graph nodes