8.Vulnerability Management with KQL

Are unpatched vulnerabilities leaving your organization exposed to cyber threats? In this post, I will explore how you can use Microsoft Defender XDR and KQL to take control of your vulnerability management. Learn how customized queries and actionable insights can help you prioritize and address security vulnerabilities, transforming raw data into a powerful defense strategy.

Agenda:

Introduction

What is Vulnerability Management

What are the benefits

My recommendations

Conclusion

 Introduction

In today’s cybersecurity landscape, vulnerability management plays a critical role in securing organizations. As attackers exploit known vulnerabilities to infiltrate networks. Proactive identification and remediation of these weaknesses become essential. Leveraging Microsoft Defender XDR and Kusto Query Language (KQL), security professionals can search for, visualize, and prioritize vulnerabilities effectively.

Patching your software—including both operating systems and applications—is fundamental to maintaining a secure environment. Unpatched vulnerabilities are one of the most exploited attack vectors, providing adversaries with opportunities to gain unauthorized access. Regular patching ensures that your systems remain resilient against known threats and reduces the risk of exploitation. Using KQL to identify vulnerabilities should complement, not replace, your patching strategy. It’s a tool to catch gaps and monitor for any missed updates, ensuring your environment remains secure.

This blog post focuses on how to use KQL in Defender XDR for vulnerability management, offering actionable insights and best practices for your organization.

What Is Vulnerability Management?

Vulnerability management is the process of identifying, evaluating, and addressing vulnerabilities in systems, applications, and networks. It involves continuous monitoring, assessment, and remediation to reduce the risk of exploitation.

Key steps in vulnerability management include:

• Discovery: Identifying assets and their associated vulnerabilities.

• Assessment: Prioritizing vulnerabilities based on risk levels.

• Remediation: Applying patches or other mitigations.

• Reporting: Keeping stakeholders informed through dashboards and reports.

In the context of Defender XDR, vulnerability management leverages endpoint telemetry, threat intelligence, and advanced query capabilities through KQL to uncover and address these security gaps efficiently. The power of KQL lies in its flexibility, enabling security teams to craft highly customized queries tailored to the organization’s specific needs. For example, KQL can help pinpoint vulnerabilities on high-value assets, track devices with unpatched critical software, or analyze exposure trends across different environments.

Security teams can use KQL to focus on targeted queries, such as identifying vulnerabilities actively exploited in the wild or correlating threat intelligence with specific devices. By enabling these focused searches, KQL empowers organizations to zero in on risks that pose the greatest threats to their infrastructure. Moreover, KQL provides granular visibility, ensuring that no vulnerabilities are overlooked, even in complex environments.

Additionally, the ability to visualize data directly from KQL queries adds another layer of value. Teams can transform raw data into actionable insights, such as graphs showing vulnerability severity distributions or trends over time. This visualization capability enhances understanding and helps communicate risks effectively to non-technical stakeholders. By leveraging KQL for tailored vulnerability management, organizations can achieve a more proactive and precise approach to reducing their attack surface.

KQL Query Examples for Vulnerability Management

• Patching Prioritization - Zero-Day Exploits

This query identifies devices accessible by critical identities holding highly privileged roles that are also vulnerable to CVE-2024-26234 and CVE-2024-29988, currently exploited in malware attacks. Plugging these vulnerabilities significantly reduces organizational risk:

let CriticalIdentities =
ExposureGraphNodes
| where set_has_element(Categories, "identity")
| where isnotnull(NodeProperties.rawData.criticalityLevel) and
NodeProperties.rawData.criticalityLevel.criticalityLevel < 4 
| distinct NodeName;
let CriticalDevices =
ExposureGraphEdges 
| where EdgeLabel == @"can authenticate to"
| join ExposureGraphNodes on $left.TargetNodeId==$right.NodeId
| extend DName = tostring(NodeProperties.rawData.deviceName)
| extend isLocalAdmin = EdgeProperties.rawData.userRightsOnDevice.isLocalAdmin
| where SourceNodeName has_any (CriticalIdentities)
| distinct DName;
DeviceTvmSoftwareVulnerabilities 
| where CveId == "CVE-2024-26234" or CveId == "CVE-2024-29988"
| where DeviceName has_any (CriticalDevices)

• Platform Version and Update Status

This query provides the platform version and the count of up-to-date devices, not-up-to-date devices, and devices whose update status is unknown:

let expiringPublishdate = ago(8d);
DeviceTvmInfoGathering
| extend DataRefreshTimestamp = Timestamp,    
AvIsPlatformUpToDateTemp=tostring(AdditionalFields.AvIsPlatformUptodate),
AvSignatureDataRefreshTime = todatetime(AdditionalFields.AvSignatureDataRefreshTime), 
AvSignaturePublishTime = todatetime(AdditionalFields.AvSignaturePublishTime),
AvPlatformVersion =  tostring(AdditionalFields.AvPlatformVersion) 
| extend AvIsPlatformUpToDate = iif(((((isempty(AvIsPlatformUpToDateTemp)
or (isnull(AvSignatureDataRefreshTime)))
or (isnull(AvSignaturePublishTime)))
or (AvSignatureDataRefreshTime < expiringPublishdate))
or (AvSignaturePublishTime < expiringPublishdate)), "Unknown", tostring(AvIsPlatformUpToDateTemp)) 
| extend AvPlatformVersion = iif(AvPlatformVersion == "", "Unknown", AvPlatformVersion)
| project DeviceId, DeviceName,  OSPlatform, AvPlatformVersion, DataRefreshTimestamp, AvIsPlatformUpToDate, AvSignaturePublishTime, AvSignatureDataRefreshTime
| summarize DeviceCount = count(), DataRefreshTimestamp = max(DataRefreshTimestamp), PlatformUpToDateDeviceCount = countif(AvIsPlatformUpToDate == "true"),  PlatformNotUpToDateDeviceCount = countif(AvIsPlatformUpToDate == "false"),  PlatformNotAvailableDeviceCount = countif(AvIsPlatformUpToDate == "Unknown") by OSPlatform,AvPlatformVersion

• Missing Security Updates

This query identifies devices with missing critical or high security updates and summarizes their information:

DeviceTvmSoftwareVulnerabilities
| where VulnerabilitySeverityLevel == 'High' or VulnerabilitySeverityLevel == 'Critical'
| where isnotempty(RecommendedSecurityUpdate)
| where RecommendedSecurityUpdate contains "Security Updates"
| summarize MissingKBUpdates = make_set(RecommendedSecurityUpdate) by DeviceId, DeviceName
| join kind=inner (DeviceInfo | summarize LastSeen = max(Timestamp) by DeviceId) on DeviceId
| project DeviceName, DeviceId, MissingKBUpdates
| order by DeviceName asc

This query ensures that you can focus remediation efforts on devices missing important security updates, reducing the risk posed by unpatched vulnerabilities.

• Visualizing Missing Security Updates

This query generates a column chart showing the count of unique devices missing specific high or critical security updates:

DeviceTvmSoftwareVulnerabilities
| where VulnerabilitySeverityLevel == 'High' or VulnerabilitySeverityLevel == 'Critical'
| where isnotempty(RecommendedSecurityUpdate)
| where RecommendedSecurityUpdate contains "Security Updates"
| summarize AffectedDevices = dcount(DeviceId) by RecommendedSecurityUpdate
| where AffectedDevices > 5
| order by AffectedDevices desc
| render columnchart

This visualization helps highlight the updates with the largest number of missing patches, allowing teams to focus on addressing vulnerabilities with the greatest impact.

What Are the Benefits?

 Effective vulnerability management provides several critical benefits:

• Improved Security Posture

A strong vulnerability management program strengthens the overall security posture of an organization by identifying and remediating weaknesses before attackers can exploit them. By reducing the attack surface, it becomes significantly harder for adversaries to gain unauthorized access to sensitive data or systems. Proactive management ensures that known vulnerabilities are patched, keeping the organization resilient to evolving threats.

• Compliance and Regulatory Adherence

Many industries are governed by stringent regulatory requirements mandating regular vulnerability assessments and timely remediation. A robust vulnerability management process not only ensures compliance with these regulations but also demonstrates a commitment to protecting sensitive information. Meeting compliance standards helps avoid penalties, protects the organization’s reputation, and builds trust with stakeholders.

• Efficient Resource Allocation

By using a structured approach to prioritize vulnerabilities based on their severity, exploitability, and potential impact, organizations can allocate resources more effectively. Teams can focus on addressing the most critical vulnerabilities first, ensuring that time and effort are spent where they matter most. This targeted approach prevents wasted effort on less significant issues, maximizing the efficiency of security operations.

• Enhanced Visibility

Vulnerability management provides a comprehensive view of the organization’s risk landscape, offering detailed insights into the state of assets, their vulnerabilities, and associated threats. Enhanced visibility enables security teams to make informed decisions, respond swiftly to emerging risks, and communicate effectively with stakeholders about the current security posture and progress in risk reduction efforts.

My Recommendations

Best Practices for Vulnerability Management in Defender XDR

• Comprehensive Vulnerability Identification

To effectively manage vulnerabilities, organizations should ensure a robust identification process. This includes leveraging telemetry from endpoint devices and cross-referencing vulnerabilities with threat intelligence to understand potential exploitation risks. This comprehensive approach ensures that no critical gaps are overlooked.

• Prioritization Based on Risk

Not all vulnerabilities pose the same level of threat. It is crucial to prioritize remediation efforts by assessing the severity of vulnerabilities, their exploitability, and the criticality of affected assets. Addressing high-risk vulnerabilities first maximizes security impact while optimizing resource allocation.

• Regular Updates and Patching

Implementing a consistent and timely patching policy is one of the most effective ways to reduce exposure to vulnerabilities. Organizations should ensure that operating systems, applications, and firmware are regularly updated to mitigate risks from known threats. Staying ahead of vulnerabilities requires maintaining discipline and diligence.

• Effective Communication and Reporting

Vulnerability management should include clear reporting to keep stakeholders informed about the organization’s risk posture and remediation progress. Visual dashboards and detailed summaries help in tracking improvements, identifying trends, and communicating the value of security efforts to leadership.

• Continuous Monitoring and Improvement

Security is not static, and neither is vulnerability management. Continuous monitoring of assets, vulnerabilities, and threat landscapes ensures that organizations can adapt to emerging risks. Regular reviews of policies and practices help maintain an effective security posture over time.

Conclusion

Vulnerability management is a cornerstone of any robust cybersecurity strategy. With tools like Defender XDR, organizations can elevate their vulnerability management practices by:

• Gaining deep insights into asset vulnerabilities.

• Prioritizing remediation efforts based on severity and threat intelligence.

• Automating routine monitoring to save time and resources.

By implementing the best practices discussed in this blog post, you’ll enhance your organization’s security posture and better protect against evolving threats.

Stay tuned for the next post in this series, where I’ll dive deeper into advanced threat hunting techniques using KQL.