KQL Search

Query Details

Local agent - VS Code launched risky MCP process

VS Code Mcp Command Capable Process

Query

DeviceProcessEvents
| where Timestamp > ago(1h)
| where InitiatingProcessFileName in~ ('code.exe', 'code-insiders.exe', 'codium.exe')
    or InitiatingProcessParentFileName in~ ('code.exe', 'code-insiders.exe', 'codium.exe')
| where ProcessCommandLine has_any ('mcp', 'modelcontextprotocol', '@modelcontextprotocol', 'mcp-server', '--mcp')
    or FileName has_any ('mcp-server', 'mcp_server')
| extend Search = tolower(strcat(FileName, ' ', ProcessCommandLine)),
    Account = coalesce(AccountUpn, AccountName, InitiatingProcessAccountUpn, InitiatingProcessAccountName)
| where ProcessTokenElevation =~ 'TokenElevationTypeFull'
    or Search matches regex @'(powershell|cmd\.exe|bash|sh |terminal|reverse[_ -]?shell|metasploit|kali|ssh)'
| extend Risk = iff(ProcessTokenElevation =~ 'TokenElevationTypeFull' or Search has_any ('reverse shell', 'metasploit', 'kali'), 'CRITICAL', 'HIGH')
| project Timestamp, DeviceId, DeviceName, ReportId, Risk, Account,
    FileName, FolderPath, ProcessCommandLine, SHA1, SHA256,
    ProcessTokenElevation, ProcessIntegrityLevel, InitiatingProcessFileName,
    InitiatingProcessCommandLine, IsProcessRemoteSession,
    ProcessRemoteSessionDeviceName, ProcessRemoteSessionIP
| order by Timestamp desc

Explanation

This query is designed to detect potentially risky activities involving Visual Studio Code (VS Code) on a device. Here's a simplified breakdown of what it does:

  1. Purpose: It identifies instances where VS Code launches a child process that might be suspicious or risky. This includes processes that are elevated (have higher permissions) or contain certain keywords associated with shell commands, remote execution, or offensive tools.

  2. Severity: The alert generated by this query is considered high severity.

  3. Frequency: The query runs every hour and checks data from the past hour.

  4. Detection Criteria:

    • It looks for processes initiated by VS Code or its variants (like code-insiders or codium).
    • It checks if the command line or file name of the process contains specific markers related to "MCP" (Model Context Protocol) or other suspicious keywords.
    • It further examines if the process has full token elevation (indicating higher privileges) or matches patterns associated with potentially malicious activities (like using PowerShell, SSH, or reverse shells).

  5. Risk Assessment:

    • If a process is fully elevated or contains critical keywords (like reverse shell or Metasploit), it is marked as "CRITICAL" risk.
    • Otherwise, it is marked as "HIGH" risk.

  6. Output: The query outputs details such as the timestamp, device information, risk level, account involved, file names, command lines, and other relevant process details.

  7. Tags: The query is tagged for use in Defender-XDR, advanced hunting, and is specifically focused on local agents and VS Code activities related to MCP.

Overall, this query helps security teams monitor and respond to potentially dangerous activities initiated by VS Code, ensuring that any unauthorized or risky actions are quickly identified and addressed.