KQL Search

Query Details

Copilot Studio - Unsafe active content in agent response

Copilot Studio Unsafe Active Content In Response

Query

AppEvents
| where Name == "BotMessageSend"
| extend ConvId=tostring(Properties["conversationId"]), ChannelId=tostring(Properties["channelId"]), Output=tostring(Properties["text"])
| where isnotempty(Output)
| extend ActiveContent=extract(@"(?i)(</?script\b|<(?:iframe|embed|object)\b|on(?:click|load|error|mouse\w*|change|input)\s*=|(?:href|src)\s*=\s*[""']?javascript\s*:|data\s*:\s*(?:text/html|application/javascript|image/svg\+xml)|&#(?:60|62|x3[cCeEfF]);)", 0, Output)
| where isnotempty(ActiveContent)
| extend AccountName=iff(isempty(UserId), "unknown-agent", UserId), Signal="UNSAFE ACTIVE CONTENT EMITTED"
| project TimeGenerated, Signal, ActiveContent, AccountName, ConvId, ChannelId, SessionId, ClientIP, AppVersion
| order by TimeGenerated desc

Explanation

This query is designed to monitor and detect potentially unsafe content in responses from a Copilot Studio bot. Here's a simple breakdown of what it does:

  1. Purpose: The query identifies active HTML, scripts, event handlers, executable URIs, or encoded tags in the bot's responses, which could indicate a security risk. It doesn't confirm execution of the unsafe content but flags its presence.

  2. Data Source: It uses data from Application Insights, specifically focusing on application events related to bot messages.

  3. Frequency: The query runs every hour and looks at data from the past hour.

  4. Detection Logic:

    • It filters events where the bot sends a message (BotMessageSend).
    • It extracts and checks the message content for patterns that match potentially unsafe active content, such as scripts or JavaScript URIs.
    • If such content is found, it marks the message as having "UNSAFE ACTIVE CONTENT EMITTED."

  5. Output: The query outputs details like the time of the event, the unsafe content detected, the account name (or "unknown-agent" if not available), conversation ID, channel ID, session ID, client IP, and app version.

  6. Alerting: If any unsafe content is detected, an alert is triggered. Alerts are grouped by account and can reopen closed incidents if similar issues are detected within a 12-hour window.

  7. Severity and Tactics: The alert is classified as medium severity and is associated with tactics like execution and defense evasion, referencing specific techniques (T1059 and T1027).

  8. Configuration: The query is scheduled to run automatically and is part of a broader security monitoring setup, tagged with relevant identifiers for easy management and categorization.

Overall, this query helps in identifying and alerting on potentially harmful content in bot responses, aiding in maintaining security and preventing exploitation.