KQL Search

Query Details

Local agent - First-seen governed MCP tool from VS Code

VS Code Mcp First Seen Gateway Tool

Query

let Calls = CloudAppEvents
| where Timestamp > ago(30d) and ActionType == 'ExecuteToolByGateway'
| extend Raw = todynamic(RawEventData), Extra = todynamic(AdditionalFields)
| extend Client = coalesce(UserAgent, tostring(Raw.clientName), tostring(Raw.client.name), tostring(Extra.clientName)),
    Agent = coalesce(tostring(Raw.agentName), tostring(Raw.agent.name), tostring(Extra.agentName)),
    McpServer = coalesce(tostring(Raw.mcpServerName), tostring(Raw.serverName), tostring(Raw.server.name), tostring(Extra.mcpServerName), ObjectName),
    Tool = coalesce(tostring(Raw.toolName), tostring(Raw.tool.name), tostring(Extra.toolName), ActivityType),
    Evidence = tolower(strcat(UserAgent, ' ', tostring(RawEventData), ' ', tostring(AdditionalFields)))
| where Evidence has_any ('visual studio code', 'vscode', 'github copilot')
| extend Account = coalesce(AccountId, AccountDisplayName, AccountObjectId),
    UsageKey = strcat(tolower(McpServer), '|', tolower(Tool));
let Baseline = Calls
| where Timestamp between (ago(30d) .. ago(1h))
| distinct Account, UsageKey;
Calls
| where Timestamp > ago(1h)
| join kind=leftanti Baseline on Account, UsageKey
| project Timestamp, ReportId, Account, AccountObjectId, AccountDisplayName,
    Client, Agent, McpServer, Tool, UsageKey, Application, IPAddress,
    CountryCode, OSPlatform, DeviceType, RawEventData, AdditionalFields
| order by Timestamp desc

Explanation

This query is designed to detect unusual activity involving a governed MCP (Managed Control Plane) server and tool that is accessed from Visual Studio Code or GitHub Copilot. Here's a simple breakdown of what it does:

  1. Purpose: It identifies instances where a user account accesses a specific MCP server and tool combination from VS Code or GitHub Copilot that they haven't used in the past 30 days.

  2. Data Source: The query looks at cloud application events from the past 30 days.

  3. Key Steps:

    • It filters events where a tool is executed via a gateway.
    • It extracts relevant information like client name, agent name, MCP server name, and tool name from raw event data and additional fields.
    • It specifically looks for evidence of usage from VS Code or GitHub Copilot.
    • It creates a baseline of MCP server and tool combinations used by each account in the past 30 days, excluding the last hour.
    • It then checks for any new combinations used in the last hour that weren't part of the baseline.

  4. Output: The query outputs details of these new, potentially suspicious activities, including timestamp, account information, client and agent details, MCP server and tool names, and other contextual information.

  5. Severity: The severity of this detection is marked as Medium, indicating a moderate level of concern.

  6. Use Case: This is useful for security teams to identify and investigate potential unauthorized or unusual tool usage from development environments like VS Code, which could indicate a security risk.

  7. Tags: The query is tagged for use with Defender-XDR, advanced hunting, and is related to local agents, VSCode, and MCP.