Copilot Studio - Command-capable and offensive MCP tools

Agent Mcp Command Execution Tools

Query

let lookback = 7d;
let Legacy = AppDependencies
| where TimeGenerated > ago(lookback)
| where AppRoleName == "Microsoft Copilot Studio" or DependencyType == "Connector"
| project TimeGenerated, OperationId, Success,
    Agent = "", Conversation = tostring(Properties["conversationId"]),
    Tool = Name, ToolType = "MCP - connector telemetry", Target = tostring(Target),
    Source = "Agent-level connector";
let Modern = AppDependencies
| where TimeGenerated > ago(lookback)
| where tostring(Properties["gen_ai.operation.name"]) == "execute_tool"
| project TimeGenerated, OperationId, Success,
    Agent = tostring(Properties["gen_ai.agent.name"]),
    Conversation = tostring(Properties["gen_ai.conversation.id"]),
    Tool = tostring(Properties["gen_ai.tool.name"]),
    ToolType = tostring(Properties["gen_ai.tool.type"]), Target = tostring(Target),
    Source = "Environment ExecuteTool";
union Legacy, Modern
| extend Search = tolower(strcat(Tool, " ", ToolType, " ", Target))
| where Search matches regex @"(run[_ -]?(shell|command|code)|execute[_ -]?(shell|command|code)|powershell|cmd\.exe|terminal|reverse[_ -]?shell|metasploit|kali|ssh[_ -]?exec|remote[_ -]?code[_ -]?execution|vulnerabilities/exec)"
| extend Risk = case(
    Search has_any ("reverse shell", "reverse_shell", "metasploit", "vulnerabilities/exec", "remote code execution"), "Critical exploitation capability",
    "High command execution capability")
| summarize Calls = count(), Failures = countif(Success == false),
    Traces = make_set(OperationId, 25), Conversations = make_set(Conversation, 25),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by Risk, Agent, Tool, ToolType, Target, Source
| order by Risk asc, Calls desc

Explanation

This query is designed to identify and analyze metadata related to potentially harmful activities involving Microsoft Copilot Studio and its connectors. It focuses on detecting tools and operations that could be used for executing arbitrary commands, code, or engaging in penetration-testing activities. Here's a simplified breakdown:

Data Collection: The query looks back over the past 7 days to gather data from the AppDependencies table. It separates the data into two categories: "Legacy" and "Modern" based on different criteria.
Legacy Data: This includes entries where the application role is "Microsoft Copilot Studio" or the dependency type is "Connector". It extracts relevant fields like TimeGenerated, OperationId, Success, and others.
Modern Data: This includes entries where the operation name is "execute_tool". It extracts similar fields as the legacy data but uses different property names.
Data Union and Filtering: The query combines both legacy and modern data sets. It then creates a searchable string from the tool name, type, and target. It filters this combined data to find entries that match specific patterns related to command execution or exploitation activities (e.g., "run shell", "execute command", "powershell", "metasploit").
Risk Assessment: For each entry that matches the patterns, it assigns a risk level. If the entry involves critical exploitation capabilities like "reverse shell" or "remote code execution", it is marked as "Critical exploitation capability". Otherwise, it is marked as "High command execution capability".
Summarization: The query summarizes the results by counting the number of calls, failures, and unique operation IDs and conversations. It also records the first and last time these activities were seen.
Ordering: The results are ordered by risk level and the number of calls.
Tactics and Techniques: The query is associated with tactics like Execution and Lateral Movement and techniques such as T1059 (Command and Scripting Interpreter) and T1210 (Exploitation of Remote Services).
Tags: It includes tags for categorization and identification purposes, such as Sentinel-As-Code, Custom, CopilotStudio, MCP, and CommandExecution.

Overall, this query helps security analysts identify potential security threats related to command execution and exploitation activities within the Microsoft Copilot Studio environment.