Hunt for Specific CVE on Onboarded Defender Devices

Subash Ghimire@iamsubashg

•updated Aug 20, 2025•1•0•25

This rule identifies devices onboarded to Microsoft Defender that are vulnerable to a specific CVE (CVE-2024-38063) by querying the DeviceTvmSoftwareVulnerabilities table and joining it with DeviceInfo to filter for onboarded devices. It aims to help identify the presence of a known vulnerability across the environment's devices.