Device or VM with critical CVSS and ExploitIsVerified.kql

DefenderXDR/Device or VM with critical CVSS and ExploitIsVerified.kql

@@ -13,3 +13,11 @@ ExposureGraphNodes
 | join ExposureGraphEdges on $left.NodeId == $right.SourceNodeId
 | project TargetNodeName, TargetNodeLabel, SourceNodeName, CVSSScore, NodeProperties
 | sort by CVSSScore desc
+
+// MITRE ATT&CK Mapping
+
+//The query focuses on identifying critical vulnerabilities with verified exploits, which aligns with several MITRE ATT&CK techniques related to vulnerability exploitation. Here are some relevant techniques:
+
+// T1190 - Exploit Public-Facing Application: This technique involves exploiting vulnerabilities in public-facing applications. Your query identifies critical vulnerabilities that could be exploited in such a manner1.
+// T1210 - Exploitation of Remote Services: This technique involves exploiting vulnerabilities in remote services. The query’s focus on verified exploits and critical severity aligns with detecting such exploitation attempts1.
+// T1068 - Exploitation for Privilege Escalation: This technique involves exploiting vulnerabilities to gain higher privileges. Critical vulnerabilities with verified exploits could be used for privilege escalation1.