Local agent - First-seen VS Code MCP process

VS Code Mcp First Seen Process

Query

let CandidateProcesses = DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName in~ ('code.exe', 'code-insiders.exe', 'codium.exe')
    or InitiatingProcessParentFileName in~ ('code.exe', 'code-insiders.exe', 'codium.exe')
| where ProcessCommandLine has_any ('mcp', 'modelcontextprotocol', '@modelcontextprotocol', 'mcp-server', '--mcp')
    or FileName has_any ('mcp-server', 'mcp_server')
| extend ProcessKey = strcat(tolower(FileName), '|', tolower(SHA1));
let Baseline = CandidateProcesses
| where Timestamp between (ago(14d) .. ago(1h))
| distinct ProcessKey;
CandidateProcesses
| where Timestamp > ago(1h)
| join kind=leftanti Baseline on ProcessKey
| extend Account = coalesce(AccountUpn, AccountName, InitiatingProcessAccountUpn, InitiatingProcessAccountName)
| project Timestamp, DeviceId, DeviceName, ReportId, Account, ProcessKey,
    FileName, FolderPath, ProcessCommandLine, SHA1, SHA256,
    ProcessVersionInfoCompanyName, ProcessVersionInfoProductName,
    ProcessTokenElevation, InitiatingProcessFileName
| order by Timestamp desc

Explanation

This query is designed to detect potentially suspicious processes related to VS Code (Visual Studio Code) that have been executed within the last hour. Here's a simplified breakdown of what it does:

Scope: It focuses on processes initiated by VS Code or its variants (code.exe, code-insiders.exe, codium.exe).
Target: The query looks for processes with names or command lines that suggest they are related to "MCP" (Model Context Protocol), such as mcp-server.
Baseline Comparison: It establishes a baseline by identifying similar processes that have run in the past 14 days but not in the last hour.
Detection: The query identifies any new MCP-like processes that have appeared in the last hour but were not present in the 14-day baseline.
Output: It provides details about these new processes, including the timestamp, device information, account details, file names, and other relevant process information.
Purpose: The goal is to detect potentially unauthorized or unexpected processes that could indicate a security issue, while acknowledging that new software versions or legitimate onboarding might also trigger these detections.
Severity and Context: The severity is marked as Medium, and it is associated with tactics like Execution and Persistence, and techniques such as T1059 (Command and Scripting Interpreter) and T1546 (Event Triggered Execution).

This query is useful for security teams using Microsoft Defender's advanced hunting capabilities to monitor and investigate unusual activities related to VS Code.