Git Critical Vulnerability CVE-2024-32002.kql

DefenderXDR/Git Critical Vulnerability CVE-2024-32002.kql

@@ -22,3 +22,13 @@ ExposureGraphEdges
 DeviceTvmSoftwareVulnerabilities 
 | where CveId == "CVE-2024-32002"
 | where DeviceName has_any (CriticalDevices)
+
+// MITRE ATT&CK Mapping
+
+// The KQL query is designed to identify critical identities and devices, and then find devices with a specific vulnerability. The associated MITRE ATT&CK techniques include:
+
+// T1078: Valid Accounts
+// T1078.001: Valid Accounts: Local Accounts
+// T1078.003: Valid Accounts: Local Administrator Account
+// T1190: Exploit Public-Facing Application
+// T1210: Exploitation of Remote Services