Foundry - Successful tool call to internal network target

Foundry Internal Network Target Tool Call

Query

let protectedContent = union isfuzzy=true
  (datatable(OperationId:string, SpanId:string, ProtectedArgs:string, ProtectedResult:string)[]),
  (AppGenAIContent
  | project OperationId=TraceId, SpanId,
      ProtectedArgs=tostring(ToolCallArguments),
      ProtectedResult=tostring(ToolCallResult));
AppDependencies
| where Success == true and isnotempty(tostring(Properties["gen_ai.tool.name"]))
| extend Agent=tostring(Properties["gen_ai.agent.name"]), Model=tostring(Properties["gen_ai.request.model"]), ConvId=tostring(Properties["gen_ai.conversation.id"]), ProjectId=tostring(Properties["microsoft.foundry.project.id"]), ToolName=tostring(Properties["gen_ai.tool.name"]), ToolType=tostring(Properties["gen_ai.tool.type"]), LegacyArgs=tostring(Properties["gen_ai.tool.call.arguments"]), LegacyResult=tostring(Properties["gen_ai.tool.call.result"]), SpanId=Id
| join kind=leftouter protectedContent on OperationId, SpanId
| extend ToolArgs=coalesce(ProtectedArgs, LegacyArgs), ToolResult=coalesce(ProtectedResult, LegacyResult)
| extend TargetUrl=extract(@"(?i)https?://[A-Za-z0-9.\-:\[\]]+", 0, strcat(ToolArgs, " ", ToolResult))
| where isnotempty(TargetUrl)
| extend TargetHost=tolower(tostring(parse_url(TargetUrl)["Host"]))
| extend TargetClass=case(
    TargetHost in ("localhost", "::1", "[::1]"), "Loopback",
    TargetHost matches regex @"^127\.", "Loopback",
    TargetHost matches regex @"^169\.254\." or TargetHost in ("metadata.google.internal", "metadata.azure.internal"), "Link-local or metadata service",
    TargetHost matches regex @"^10\." or TargetHost matches regex @"^192\.168\." or TargetHost matches regex @"^172\.(1[6-9]|2[0-9]|3[01])\.", "RFC1918 private network",
    "Public")
| where TargetClass != "Public"
| extend AccountName=iff(isempty(Agent), "unknown-agent", Agent)
| project TimeGenerated, Signal="SUCCESSFUL INTERNAL-TARGET TOOL CALL", TargetClass, TargetUrl, TargetHost, AccountName, Agent, Model, ProjectId, ConvId, ToolName, ToolType, OperationId, SpanId
| order by TimeGenerated desc

Explanation

This query is designed to detect potentially suspicious activity involving internal network targets accessed by a tool within an application. Here's a simplified breakdown of what it does:

Purpose: The query identifies successful calls made by a tool (referred to as "Foundry") to internal network targets. These targets include loopback addresses, link-local addresses, cloud metadata services, and private network addresses as defined by RFC1918.
Data Sources: It uses data from Application Insights, specifically focusing on application dependencies and AI-generated content.
Detection Logic:
- It first gathers relevant data about tool calls, including arguments and results.
- It checks for successful tool calls and extracts URLs from the tool's arguments and results.
- It classifies the target URLs based on their hostnames to determine if they are loopback, link-local, cloud metadata, or private network addresses.
- It filters out public addresses, focusing only on internal targets.
Output: The query generates a list of successful tool calls to internal targets, including details like the target URL, target class (e.g., loopback, private network), tool name, and associated account or agent.
Severity and Actions: The query is marked with high severity, indicating a significant concern for potential security risks like Server-Side Request Forgery (SSRF). It suggests reviewing the tool's implementation and logs to assess the risk of exploitation.
Alerting and Incident Management: If any such activity is detected, an alert is generated, and incidents can be created and grouped based on the account involved. The system is configured to reopen closed incidents if similar activity is detected within a 12-hour lookback period.
Tags and Classification: The query is tagged with relevant terms like SSRF, AI, and OWASP-LLM06, indicating its focus on security and AI-related activities.

Overall, this query helps security teams monitor and investigate potential misuse of internal network resources by tools within their applications, providing a mechanism to detect and respond to potential security threats.