Devices with Specified Vulnerable Software Installed
This query identifies devices that have specific software installed, enriching this information with device details like OS, exposure level, and internet-facing status. This is useful for asset inventory and identifying potentially exposed endpoints, especially when vulnerability information might not be immediately available through other means. The current rule is configured to detect "Acronis Cyber Protect" software.
Microsoft Sentinel (KQL)
