Local agent - Risky VS Code MCP configuration

VS Code Mcp Risky Configuration

Query

AgentsInfo
| where Timestamp > ago(1h) and Platform == 'LocalAgents'
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus !in~ ('Deleted', 'Uninstalled')
| extend Metadata = RawAgentInfo.localAgentMetadata,
    Process = tolower(tostring(RawAgentInfo.localAgentMetadata.relatedProcess)),
    RawText = tolower(tostring(RawAgentInfo))
| where Process has_any ('code.exe', 'code-insiders.exe', 'codium.exe', 'visual studio code')
    or RawText has_any ('vscode', 'visual studio code', 'code.exe', 'code-insiders.exe', 'codium.exe')
| extend DeviceName = tostring(Metadata.deviceName), AccountName = tostring(Metadata.accountName),
    AutoApprove = tostring(Metadata.autoApprove), TrustedProcess = tostring(Metadata.trustedProcess),
    Config = tolower(strcat(tostring(Metadata.localMcps), ' ', tostring(McpServers), ' ', tostring(DeclaredTools)))
| extend HasExternalMcp = Config has 'http://' or Config has 'https://',
    HasCommandCapability = Config matches regex @'(run[_ -]?(shell|command|code)|execute[_ -]?(shell|command|code)|powershell|cmd\.exe|terminal|reverse[_ -]?shell|metasploit|kali|ssh)'
| where AutoApprove =~ 'true' or TrustedProcess =~ 'false' or HasExternalMcp or HasCommandCapability
| extend RiskReason = strcat(
    iff(AutoApprove =~ 'true', 'AutoApprove;', ''),
    iff(TrustedProcess =~ 'false', 'UntrustedProcess;', ''),
    iff(HasExternalMcp, 'ExternalMcp;', ''),
    iff(HasCommandCapability, 'CommandCapability;', ''))
| project Timestamp, AgentId, Agent = Name, Vendor = tostring(Metadata.vendor),
    Version, DeviceName, AccountName, Process, AutoApprove, TrustedProcess,
    RiskReason, McpServers = tostring(McpServers), LocalMcps = tostring(Metadata.localMcps),
    DeclaredTools = tostring(DeclaredTools)
| order by Timestamp desc

Explanation

This query is designed to detect potentially risky configurations in Visual Studio Code (VS Code) local-agent profiles. Here's a simplified breakdown of what it does:

Data Source: It examines information from AgentsInfo related to local agents on a platform called 'LocalAgents'.
Time Frame: It looks at data from the past hour.
Filtering: It focuses on agents that are not deleted or uninstalled and checks for specific processes related to VS Code, such as code.exe or visual studio code.
Risk Indicators: The query identifies risky configurations by checking if:
- Actions are auto-approved.
- The process is running under an untrusted host.
- There are references to external URLs.
- There is command-capable metadata (e.g., ability to run shell commands).
Risk Reason: It compiles reasons for risk, such as auto-approval being enabled, the process being untrusted, external MCP references, or command capabilities.
Output: The results include details like the timestamp, agent ID, agent name, vendor, version, device name, account name, process, and reasons for risk.
Sorting: The results are ordered by the most recent timestamp.
Tags: The query is tagged for use in Defender-XDR, Advanced Hunting, Local Agents, VSCode, and MCP contexts.

Overall, this query helps identify potentially insecure configurations in VS Code that could lead to unauthorized actions or exploitation.