Microsoft 365 Copilot - Plugin lifecycle anomaly

Copilot Plugin Lifecycle Anomaly

Query

let lifecycleTypes=dynamic(["CreateCopilotPlugin", "UpdateCopilotPlugin", "EnableCopilotPlugin", "DisableCopilotPlugin"]);
let baseline=CopilotActivity
| where TimeGenerated between (ago(14d) .. ago(1h)) and RecordType in (lifecycleTypes)
| summarize BaselineChanges=count() by ActorUserId;
let recent=CopilotActivity
| where TimeGenerated > ago(1h) and RecordType in (lifecycleTypes)
| summarize RecentChanges=count(), ActivationEvents=countif(RecordType in ("CreateCopilotPlugin", "EnableCopilotPlugin")), DistinctAgents=dcount(AgentId), RecordTypes=make_set(RecordType, 8), AgentIds=make_set(AgentId, 16), AgentNames=make_set(AgentName, 16), ActorName=take_any(ActorName), SrcIpAddr=take_any(SrcIpAddr), TenantId=take_any(TenantId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ActorUserId;
recent
| join kind=leftouter baseline on ActorUserId
| extend BaselineChanges=coalesce(BaselineChanges, 0)
| where (BaselineChanges == 0 and ActivationEvents >= 1) or RecentChanges >= 3 or DistinctAgents >= 3
| extend TimeGenerated=LastSeen, Signal=case(BaselineChanges == 0 and ActivationEvents >= 1, "FIRST-SEEN PLUGIN ACTIVATION", RecentChanges >= 3, "PLUGIN LIFECYCLE BURST", "MULTI-AGENT PLUGIN CHANGE")
| project TimeGenerated, Signal, ActorName, ActorUserId, SrcIpAddr, TenantId, RecentChanges, ActivationEvents, BaselineChanges, DistinctAgents, RecordTypes, AgentIds, AgentNames, FirstSeen, LastSeen
| order by RecentChanges desc

Explanation

This query is designed to detect unusual activities related to Microsoft 365 Copilot plugins. It looks for three specific types of anomalies:

First-Seen Plugin Activation: It identifies when a user (actor) creates or enables a Copilot plugin for the first time within the last hour, indicating a new or unusual activity by that user.
Plugin Lifecycle Burst: It detects a sudden increase or burst of at least three changes in the plugin lifecycle (such as creating, updating, enabling, or disabling plugins) by a user within the last hour.
Multi-Agent Plugin Change: It identifies changes made across at least three different agents (systems or devices) by a user within the last hour.

The query uses data from the past 14 days to establish a baseline of normal activity and compares it to recent activity within the last hour. If any of the above conditions are met, it generates an alert with details about the user, the type of anomaly detected, and other relevant information.

The query is scheduled to run every hour and is set to create incidents if anomalies are detected, with the ability to group related alerts into a single incident for easier management. The severity of the alert is marked as medium, and it focuses on tactics related to persistence and privilege escalation, with specific techniques referenced (T1098 and T1505).