Copilot Studio - Untrusted connector target (allowlist join)

Agent Untrusted Connector Target

Query

let lookback = 1d;
let trusted =
    _GetWatchlist('CopilotStudioTrustedConnectors')
    | project ConnectorTarget = tolower(tostring(column_ifexists('ConnectorTarget', '')))
    | where isnotempty(ConnectorTarget);
  let Legacy = AppDependencies
  | where TimeGenerated > ago(lookback)
  | where AppRoleName == "Microsoft Copilot Studio" or DependencyType == "Connector"
  | extend ConvId = tostring(Properties["conversationId"]),
       ChannelId = tostring(Properties["channelId"]),
       Tool = Name, ToolType = "MCP - connector telemetry",
       ResourceKey = tolower(tostring(Target)),
       ResourcePrefix = tolower(tostring(split(Target, "/")[0])),
       Source = "Agent-level connector";
  let Modern = AppDependencies
  | where TimeGenerated > ago(lookback)
  | where tostring(Properties["gen_ai.operation.name"]) == "execute_tool"
  | extend Tool = tostring(Properties["gen_ai.tool.name"]),
       ToolType = tostring(Properties["gen_ai.tool.type"])
  | where Tool has "mcp" or ToolType has "mcp"
  | extend ConvId = tostring(Properties["gen_ai.conversation.id"]), ChannelId = "",
       ResourceKey = tolower(iff(Target == "GenAI" or isempty(Target), Tool, tostring(Target))),
       ResourcePrefix = tolower(tostring(split(iff(Target == "GenAI" or isempty(Target), Tool, tostring(Target)), "/")[0])),
       Source = "Environment ExecuteTool";
  union Legacy, Modern
  | extend Trusted = ResourcePrefix in (trusted) or ResourceKey in (trusted)
| where not(Trusted)
  | summarize Calls = count(), Convs = make_set(ConvId, 25),
    Channels = make_set(ChannelId, 10), FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by Tool, ToolType, Target, ResourceKey, ResourcePrefix, Source
| order by Calls desc

Explanation

This query is designed to identify potentially unauthorized or suspicious activity involving Microsoft Copilot Studio connectors or tools. Here's a simplified breakdown:

Purpose: The query checks if any connector or tool actions are targeting endpoints not listed in an approved watchlist called CopilotStudioTrustedConnectors. This helps detect unauthorized data transfers or configuration issues.
Watchlist: It uses a watchlist to define trusted targets. Only targets listed in this watchlist are considered safe.
Data Sources: The query examines two types of data:
- Legacy Data: This includes older connector telemetry data from the AppDependencies table, focusing on actions related to Microsoft Copilot Studio or connectors.
- Modern Data: This includes newer telemetry data related to tool executions, specifically those involving AI operations.
Time Frame: The query looks at data from the past day (lookback = 1d).
Processing:
- It extracts relevant information like conversation IDs, channel IDs, tool names, and resource keys.
- It checks if these resource keys or prefixes are in the trusted watchlist.
Filtering: The query filters out any actions that are not trusted, meaning their targets are not in the approved list.
Output: It summarizes the results by counting occurrences, listing unique conversation and channel IDs, and noting the first and last time the activity was seen. The results are sorted by the number of calls, highlighting the most frequent untrusted actions.
Security Context: The query is associated with tactics like Exfiltration and Command and Control, and techniques such as T1567 (Data Exfiltration) and T1071 (Application Layer Protocol).

Overall, this query helps monitor and flag potentially malicious or unauthorized activities by identifying actions targeting unapproved endpoints.