devices_with_vuln_and_users_received_payload (1)

id: 9c2ba784-c664-40f1-b0df-8f34c6626be5
name: devices_with_vuln_and_users_received_payload (1)
description: |
  // Author: jan geisbauer
  // @janvonkirchheim
  // ------------------------
  // 1.	A list of all devices that have this vulnerability
  // 2.	A list of all users that uses those devices
  // 3.	If these users received .mkv files recently
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceTvmSoftwareVulnerabilities
  - DeviceFileEvents
query: |
  // 1.	A list of all devices that have this vulnerability
  // 2.	A list of all users that uses those devices
  // If these users opened those .mkv files
  let all_computers_with_vlcvln=
  DeviceTvmSoftwareVulnerabilities 
  | where SoftwareName contains "vlc" 
  | summarize makelist(DeviceName);
  DeviceFileEvents 
  | where DeviceName  in (all_computers_with_vlcvln)
  | where FileName contains "mkv"