Copilot Studio - Command-capable or offensive MCP tool invoked

Copilot Studio Mcp Command Execution Tool

Query

let Legacy = AppDependencies
| where AppRoleName == "Microsoft Copilot Studio" or DependencyType == "Connector"
| project TimeGenerated, OperationId, Success, ResultCode, DurationMs, ClientIP,
    Agent = "", User = "", ConvId = tostring(Properties["conversationId"]),
    Tool = Name, ToolType = "MCP - connector telemetry", Target = tostring(Target),
    Source = "Agent-level connector";
let Modern = AppDependencies
| where tostring(Properties["gen_ai.operation.name"]) == "execute_tool"
| project TimeGenerated, OperationId, Success, ResultCode, DurationMs, ClientIP,
    Agent = tostring(Properties["gen_ai.agent.name"]),
    User = coalesce(tostring(Properties["user.email"]), tostring(Properties["user.id"])),
    ConvId = tostring(Properties["gen_ai.conversation.id"]),
    Tool = tostring(Properties["gen_ai.tool.name"]),
    ToolType = tostring(Properties["gen_ai.tool.type"]), Target = tostring(Target),
    Source = "Environment ExecuteTool";
union Legacy, Modern
| extend Search = tolower(strcat(Tool, " ", ToolType, " ", Target))
| where Search matches regex @"(run[_ -]?(shell|command|code)|execute[_ -]?(shell|command|code)|powershell|cmd\.exe|terminal|reverse[_ -]?shell|metasploit|kali|ssh[_ -]?exec|remote[_ -]?code[_ -]?execution|vulnerabilities/exec)"
| extend Risk = case(
    Search has_any ("reverse shell", "reverse_shell", "metasploit", "vulnerabilities/exec", "remote code execution"), "Critical exploitation capability",
    "High command execution capability")
| extend AccountName = coalesce(User, Agent, strcat("tool:", Tool))
| summarize Calls = count(), Failures = countif(Success == false),
    ResultCodes = make_set(ResultCode, 10), Conversations = make_set(ConvId, 25),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    ClientIP = take_any(ClientIP)
    by Risk, AccountName, Agent, Tool, ToolType, Target, Source
| extend TimeGenerated = LastSeen
| project TimeGenerated, FirstSeen, LastSeen, Risk, AccountName, ClientIP,
    Agent, Tool, ToolType, Target, Source, Calls, Failures, ResultCodes, Conversations
| order by LastSeen desc

Explanation

This query is designed to monitor and raise alerts for suspicious activities involving the Copilot Studio agent when it invokes a Managed Command Platform (MCP) server or tool. Here's a simplified breakdown of what the query does:

Purpose: It detects when a Copilot Studio agent uses tools that can execute commands, run shells, or perform actions typically associated with penetration testing or remote code execution. Such activities are unusual for a production environment and may indicate a security risk.
Data Sources: The query uses data from Application Insights, specifically looking at application dependencies.
Detection Logic:
- It checks both legacy and modern telemetry data.
- It identifies tools and operations that match certain patterns related to command execution (e.g., "run shell", "execute command", "powershell", "metasploit").
- It categorizes the risk level of the detected activity as either "Critical exploitation capability" or "High command execution capability".
Output: The query summarizes the findings by counting the number of calls, failures, and unique result codes. It also tracks the first and last time the activity was seen, along with the client IP address.
Alerting: If any suspicious activity is detected, it triggers an alert with a high severity level. The alert includes details such as the risk level, account name, client IP, and other relevant information.
Incident Management: The query is configured to create incidents for detected activities, grouping them by account and looking back over a 6-hour period to identify related activities.
Frequency: The query runs every hour and checks data from the past hour.

Overall, this query helps security teams monitor for unauthorized or potentially harmful command executions within their environment, allowing for timely investigation and response.