From 434d8460d406a5acfca8f71194b812b6ee0eeb79 Mon Sep 17 00:00:00 2001
From: Sudarta <sudarta@Sudartas-MacBook-Air.local>
Date: Fri, 8 Aug 2025 19:36:58 +0530
Subject: [PATCH 1/4] Added DetectCVEExplot file

---
 DefenderXDR/DetectCVEexploits.kql | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 DefenderXDR/DetectCVEexploits.kql

diff --git a/DefenderXDR/DetectCVEexploits.kql b/DefenderXDR/DetectCVEexploits.kql
new file mode 100644
index 0000000..fc7742d
--- /dev/null
+++ b/DefenderXDR/DetectCVEexploits.kql
@@ -0,0 +1,16 @@
+// Get all the TVM data
+let tvm_data = DeviceTvmSoftwareVulnerabilities
+| distinct DeviceName, SoftwareName, SoftwareVendor, SoftwareVersion, CveId, VulnerabilitySeverityLevel;
+// Get CVE signatures on the network
+DeviceNetworkEvents
+| where ActionType contains "NetworkSignatureInspected"
+| extend AdditionalFields = todynamic(AdditionalFields)
+| extend SignatureName = tostring(AdditionalFields.SignatureName),
+    SignatureMatchedContent = tostring(AdditionalFields.SignatureMatchedContent),
+    SamplePacketContent = tostring(AdditionalFields.SamplePacketContent)
+| where SignatureName contains "CVE"
+// Join the TVM data of the related device
+| join kind=inner tvm_data on DeviceName
+// Check if the server is vulnerable to the detected CVE in network traffic
+| where SignatureName == CveId
+| project-away DeviceName1
\ No newline at end of file

From 3d8a2f07382c3221bd8bd52f4e8a886f183ee992 Mon Sep 17 00:00:00 2001
From: Sudarta <sudarta@Sudartas-MacBook-Air.local>
Date: Fri, 29 Aug 2025 16:34:02 +0530
Subject: [PATCH 2/4] adding mfa bypass file

---
 Sentinel/AADMFABypass.kql | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 Sentinel/AADMFABypass.kql

diff --git a/Sentinel/AADMFABypass.kql b/Sentinel/AADMFABypass.kql
new file mode 100644
index 0000000..0f2cb77
--- /dev/null
+++ b/Sentinel/AADMFABypass.kql
@@ -0,0 +1,15 @@
+SigninLogs
+  | where AuthenticationRequirement != "multiFactorAuthentication"
+  | where HomeTenantId == ResourceTenantId
+  | where tostring(NetworkLocationDetails) == "[]"
+  | where ResultType == 0
+  | where ConditionalAccessStatus == "success"
+  | where todynamic(AuthenticationDetails)[0].authenticationMethod != "Windows Hello for Business"
+  | where AppDisplayName != "Microsoft Intune Company Portal"
+  | where AppDisplayName != "Microsoft Intune Web Company Portal"
+  | where AppDisplayName != "Microsoft Office Web Apps Service"
+  | where AppDisplayName != "Microsoft Account Controls V2"
+  | where ResourceDisplayName != "Microsoft Intune Enrollment"
+  | project UserPrincipalName, UserId, AppDisplayName, ResourceDisplayName, NetworkLocationDetails, AuthenticationRequirement
+  | summarize count() by UserPrincipalName, AppDisplayName, ResourceDisplayName, AuthenticationRequirement
+  | sort by UserPrincipalName asc, count_ desc
\ No newline at end of file

From b1c74625497670466d5755b773c5403480faaaba Mon Sep 17 00:00:00 2001
From: Sudarta <sudarta@Sudartas-MacBook-Air.local>
Date: Fri, 29 Aug 2025 17:00:20 +0530
Subject: [PATCH 3/4] adding new file for new devices

---
 Sentinel/AADNewDevices.kql | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 Sentinel/AADNewDevices.kql

diff --git a/Sentinel/AADNewDevices.kql b/Sentinel/AADNewDevices.kql
new file mode 100644
index 0000000..4bef810
--- /dev/null
+++ b/Sentinel/AADNewDevices.kql
@@ -0,0 +1,17 @@
+|
+// Newly registered devices in Azure AD [DCSecurityOperations].
+  let NewDevices = AuditLogs
+      | where OperationName == "Register device"
+      | project TimeGenerated, DeviceID=AdditionalDetails[4].value, OS=AdditionalDetails[3].value, DeviceTrustType=AdditionalDetails[2].value, InitiatedBy=InitiatedBy.user.userPrincipalName;
+  let DisplayNames = AuditLogs
+      | where OperationName == "Add device"
+      | extend Replaced=replace_string(tostring(TargetResources[0].modifiedProperties[6].newValue), '[\"', '')
+      | project DeviceID=replace_string(Replaced, '\"]', ''), DeviceName=TargetResources[0].displayName;
+  NewDevices
+      | extend DeviceID = tostring(DeviceID)
+      | join kind=inner (
+          DisplayNames
+          | extend DeviceID = tostring(DeviceID)
+      ) on $left.DeviceID == $right.DeviceID
+      | summarize by TimeGenerated, DeviceID, tostring(DeviceName), tostring(OS), tostring(DeviceTrustType), tostring(InitiatedBy)
+      | order by TimeGenerated
\ No newline at end of file

From 5af75b63003f69af16f2cdb07c75b3a65debb7d7 Mon Sep 17 00:00:00 2001
From: Sudarta <sudarta@Sudartas-MacBook-Air.local>
Date: Fri, 29 Aug 2025 17:24:15 +0530
Subject: [PATCH 4/4] modified new file for new devices

---
 Sentinel/AADNewDevices.kql | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Sentinel/AADNewDevices.kql b/Sentinel/AADNewDevices.kql
index 4bef810..cf15256 100644
--- a/Sentinel/AADNewDevices.kql
+++ b/Sentinel/AADNewDevices.kql
@@ -1,4 +1,3 @@
-|
 // Newly registered devices in Azure AD [DCSecurityOperations].
   let NewDevices = AuditLogs
       | where OperationName == "Register device"