Leveraging DefenderXDR Exposure Management, I developed a KQL query that replicates this attack path functionality. The following KQL checks all Critical Identities (in my use case, line 6 limits to GA accounts only; removing this line will include all critical identities) and identifies which devices have their Entra browser cookie credentials stored, then checks if these devices have any critical vulnerabilities.
LinkedIn Post:
https://www.linkedin.com/posts/0x534c_exposuremanagement-attackpaths-critical-activity-7227325225493803009-o5te/
SlimKQL Github Repo:
https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/main/DefenderXDR/Detect%20vulnerable%20device%20with%20Global%20Admin%20browser%20cookie%20credential.kql
Microsoft
