Foundry - Exploit intent followed by MCP command execution

Foundry Mcp Exploit Intent Execution Chain

Query

let Inputs = union isfuzzy=true
(AppDependencies
| where isnotempty(tostring(Properties["gen_ai.agent.name"]))
| extend ContentKey = strcat(OperationId, ":", Id), TraceId = OperationId,
    InputAgent = tostring(Properties["gen_ai.agent.name"]),
    InputConversation = tostring(Properties["gen_ai.conversation.id"]),
    Content = tostring(Properties["gen_ai.input.messages"]),
    Source = "Legacy dependency content"),
(AppGenAIContent
| extend ContentKey = strcat(TraceId, ":", SpanId),
    InputAgent = tostring(AgentName),
    InputConversation = tostring(Attributes["gen_ai.conversation.id"]),
    Content = tostring(InputMessages),
    Source = "Protected GenAI content")
| where isnotempty(Content)
| summarize arg_max(TimeGenerated, *) by ContentKey
| where Content has_any ("remote code execution", "reverse shell", "metasploit", "run_shell_command", "vulnerabilities/exec", "kali linux", "execute command")
    or Content matches regex @"(?i)(execute|run).{0,40}(command|shell|powershell|terminal)"
| summarize IntentTime = max(TimeGenerated), InputSources = make_set(Source, 3),
    InputAgent = take_any(InputAgent), InputConversation = take_any(InputConversation)
    by TraceId;
let CommandTools = AppDependencies
| where isnotempty(tostring(Properties["gen_ai.tool.name"]))
| extend
    Agent = tostring(Properties["gen_ai.agent.name"]),
    Model = tostring(Properties["gen_ai.request.model"]),
    ConvId = tostring(Properties["gen_ai.conversation.id"]),
    ToolName = tostring(Properties["gen_ai.tool.name"]),
    ToolType = tostring(Properties["gen_ai.tool.type"]),
    ToolDescription = tostring(Properties["gen_ai.tool.description"]),
    ServerLabel = coalesce(tostring(Properties["gen_ai.tool.server_label"]), tostring(Properties["mcp.server.label"]), tostring(Properties["server_label"])),
    ServerUrl = coalesce(tostring(Properties["gen_ai.tool.server_url"]), tostring(Properties["mcp.server.url"]), tostring(Properties["server_url"])),
    Operation = tostring(Properties["gen_ai.operation.name"])
| extend McpServer = coalesce(ServerUrl, ServerLabel, tostring(Target))
| where ToolType has "mcp" or Operation has "mcp" or ToolName has "mcp" or ToolDescription has "mcp" or McpServer has "mcp"
| extend Search = tolower(strcat(ToolName, " ", ToolDescription, " ", McpServer))
| where Search matches regex @"(run[_ -]?(shell|command|code)|execute[_ -]?(shell|command|code)|powershell|cmd\.exe|terminal|reverse[_ -]?shell|metasploit|kali|ssh[_ -]?exec|remote[_ -]?code[_ -]?execution|vulnerabilities/exec)"
| summarize ToolTime = max(TimeGenerated), Tools = make_set(ToolName, 20),
    McpServers = make_set(McpServer, 10), ToolCalls = count(),
    SuccessfulCalls = countif(Success == true), ToolFailures = countif(Success == false),
    ToolAgent = take_any(Agent), ToolConversation = take_any(ConvId),
    Model = take_any(Model), McpServer = take_any(McpServer)
    by OperationId;
Inputs
| join kind=inner CommandTools on $left.TraceId == $right.OperationId
| extend Agent = coalesce(InputAgent, ToolAgent),
    ConvId = coalesce(InputConversation, ToolConversation),
    Signal = iff(SuccessfulCalls > 0, "CRITICAL - exploit intent with successful command-capable call", "HIGH - exploit intent with failed command-capable call")
| extend AccountName = iff(isempty(Agent), "unknown-agent", Agent),
    McpServerUrl = iff(McpServer startswith "http://" or McpServer startswith "https://", McpServer, "")
| project ToolTime, IntentTime, Signal, AccountName, Agent, Model, ConvId,
    TraceId, McpServer, McpServerUrl, McpServers, Tools, ToolCalls,
    SuccessfulCalls, ToolFailures, InputSources
| order by ToolTime desc

Explanation

This query is designed to detect potential security threats by identifying instances where there is an intent to exploit or execute remote commands, followed by the actual execution of such commands using a command-capable tool, within the same trace of activity. Here's a simplified breakdown:

Purpose: The query aims to find cases where there is both an intent to exploit (like running unauthorized commands) and the actual execution of these commands using a specific tool, which increases the confidence that a real threat is present.
Data Sources: It uses data from two sources: legacy application dependencies and protected AI-generated content. It combines these sources to ensure comprehensive detection.
Detection Logic:
- It first looks for signs of exploit intent in recorded inputs, such as mentions of "remote code execution" or "run_shell_command".
- It then checks for the execution of commands using tools that are capable of executing such commands (referred to as MCP tools).
Output: If both intent and execution are detected, it provides details like the agent involved, the conversation ID, the server used, and whether the command execution was successful. This helps in assessing the severity and potential impact of the threat.
Severity and Response: The severity is marked as high, and the system is set to create an incident if such activity is detected. It also groups related incidents for easier management.
Frequency: The query runs every hour to ensure timely detection of threats.
Tags and Techniques: It is associated with specific tactics and techniques related to defense evasion and execution, as well as relevant security frameworks like OWASP.

Overall, this query is part of a security monitoring system that helps detect and respond to potential security threats involving unauthorized command execution.