CVE-2023-38545 detection based on usage of curl process and TVM data in MDE

HuntForCVE-2023-38545.kql

// List all devices that have curl installed or use curl.
let ProcessBasedDevices = DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where ProcessCommandLine has "curl" and FileName != "SenseNdr.exe"
    | extend Method = "Process"
    | summarize by DeviceId, DeviceName, Method;
let TVMBasedDevices = DeviceTvmSoftwareInventory
    | where SoftwareName has "curl"
    | extend Method = "Software Inventory"
    | project DeviceId, DeviceName, Method, SoftwareName, SoftwareVersion, SoftwareVendor;
union ProcessBasedDevices, TVMBasedDevices
| summarize DetectionMethod = make_set(Method) by DeviceId, DeviceName

socks5-usage.kql

DeviceProcessEvents
| where ProcessCommandLine contains "curl" and FileName != "SenseNdr.exe"
| where ProcessCommandLine contains "socks5"