Detection rules › Kusto
Detect CVE exploits on network for which a device is vulnerable
This detection query can be used to find specific CVE exploits passing on the wire for which the device is vulnerable. This query should have a very high TP rate, and can be considered as a 'High severity' query.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Privilege Escalation | |
| Lateral Movement |
References
Telemetry coverage
Rule body
// Get all the TVM data
let tvm_data = DeviceTvmSoftwareVulnerabilities
| distinct DeviceName, SoftwareName, SoftwareVendor, SoftwareVersion, CveId, VulnerabilitySeverityLevel;
// Get CVE signatures on the network
DeviceNetworkEvents
| where ActionType contains "NetworkSignatureInspected"
| extend AdditionalFields = todynamic(AdditionalFields)
| extend SignatureName = tostring(AdditionalFields.SignatureName),
SignatureMatchedContent = tostring(AdditionalFields.SignatureMatchedContent),
SamplePacketContent = tostring(AdditionalFields.SamplePacketContent)
| where SignatureName contains "CVE"
// Join the TVM data of the related device
| join kind=inner tvm_data on DeviceName
// Check if the server is vulnerable to the detected CVE in network traffic
| where SignatureName == CveId
| project-away DeviceName1
Stages and Predicates
Let binding: tvm_data
let tvm_data = DeviceTvmSoftwareVulnerabilities
| distinct DeviceName, SoftwareName, SoftwareVendor, SoftwareVersion, CveId, VulnerabilitySeverityLevel;
Stage 1: source
let tvm_data
Stage 2: source
DeviceNetworkEvents
Stage 3: where
where ActionType contains "NetworkSignatureInspected"
Stage 4: extend
extend AdditionalFields
Stage 5: extend
extend SamplePacketContent, SignatureMatchedContent, SignatureName
Stage 6: where
where SignatureName contains "CVE"
Stage 7: join
join kind=inner (tvm_data) on DeviceName
Stage 8: where
where SignatureName =~ CveId
Stage 9: project-away
project-away DeviceName1
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ActionType | contains |
| field:"ActionType" kind:contains value:"NetworkSignatureInspected" |
SignatureName | contains |
| field:"SignatureName" kind:contains value:"CVE" |
SignatureName | cross_field_compare |
| field:"SignatureName" kind:cross_field_compare value:"CveId" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
AdditionalFields | extend |
SamplePacketContent | extend |
SignatureMatchedContent | extend |
SignatureName | extend |