Foundry - Command-capable MCP tool executed

Foundry Mcp Command Tool Execution

Query

AppDependencies
| where Success == true and isnotempty(tostring(Properties["gen_ai.tool.name"]))
| extend
    Agent = tostring(Properties["gen_ai.agent.name"]),
    Model = tostring(Properties["gen_ai.request.model"]),
    ConvId = tostring(Properties["gen_ai.conversation.id"]),
    ToolName = tostring(Properties["gen_ai.tool.name"]),
    ToolType = tostring(Properties["gen_ai.tool.type"]),
    ToolDescription = tostring(Properties["gen_ai.tool.description"]),
    ServerLabel = coalesce(tostring(Properties["gen_ai.tool.server_label"]), tostring(Properties["mcp.server.label"]), tostring(Properties["server_label"])),
    ServerUrl = coalesce(tostring(Properties["gen_ai.tool.server_url"]), tostring(Properties["mcp.server.url"]), tostring(Properties["server_url"])),
    Operation = tostring(Properties["gen_ai.operation.name"])
| extend McpServer = coalesce(ServerUrl, ServerLabel, tostring(Target))
| where ToolType has "mcp" or Operation has "mcp" or ToolName has "mcp" or ToolDescription has "mcp" or McpServer has "mcp"
| extend Search = tolower(strcat(ToolName, " ", ToolDescription, " ", McpServer))
| where Search matches regex @"(run[_ -]?(shell|command|code)|execute[_ -]?(shell|command|code)|powershell|cmd\.exe|terminal|reverse[_ -]?shell|metasploit|kali|ssh[_ -]?exec|remote[_ -]?code[_ -]?execution|vulnerabilities/exec)"
| extend Signal = case(Search has_any ("reverse shell", "reverse_shell", "metasploit", "vulnerabilities/exec", "remote code execution"), "CRITICAL - exploitation capability executed", "HIGH - command execution capability executed")
| summarize
    Calls = count(),
    Conversations = dcountif(ConvId, isnotempty(ConvId)),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    Model = take_any(Model),
    Signal = take_any(Signal)
    by Agent, ToolName, McpServer
| extend
    AccountName = iff(isempty(Agent), "unknown-agent", Agent),
    McpServerUrl = iff(McpServer startswith "http://" or McpServer startswith "https://", McpServer, "")
| project LastSeen, Signal, AccountName, Agent, Model, ToolName,
    McpServer, McpServerUrl, Calls, Conversations, FirstSeen
| order by LastSeen desc

Explanation

This query is designed to detect and alert on the execution of potentially harmful commands using a Microsoft Foundry MCP tool. Here's a simplified breakdown:

Purpose: The query identifies instances where a Microsoft Foundry MCP tool is used to execute commands or code that could indicate malicious activity, such as running shell commands, using offensive tools, or performing remote code execution.
Data Source: It uses data from Application Insights, specifically looking at application dependencies.
Detection Logic:
- It filters for successful executions of tools with names or descriptions that suggest command or code execution capabilities.
- It checks if the tool name, type, description, or server metadata contains "mcp" (indicating it's an MCP tool).
- It searches for specific patterns in the tool's metadata that suggest risky operations, such as "run shell", "execute command", "powershell", "reverse shell", etc.
Severity and Signals:
- If certain critical patterns are found (e.g., "reverse shell", "metasploit"), it marks the event as "CRITICAL".
- Otherwise, it marks it as "HIGH" if command execution capabilities are detected.
Output:
- It summarizes the findings by counting the number of calls and unique conversations, and records the first and last seen times.
- It provides details like the agent name, tool name, server information, and the severity signal.
Alerting:
- The query is scheduled to run every hour.
- It creates incidents for detected events, grouping them by account and allowing for incident reopening if similar activity is detected within 12 hours.
Entity Mapping: It maps the detected data to entities like Account, Cloud Application, and URL for better context in alerts.
Tags and Versioning: The query is tagged for easy identification and is versioned as 1.0.0. Overall, this query helps in monitoring and alerting on potentially dangerous command executions using MCP tools, aiding in the prevention of security breaches.