What Changed
Four net-new hunting queries have been added under Hunting Queries/AI Agents/, all operating against the AgentsInfo table (Microsoft 365 Copilot agent inventory). Each query uses a 14-day lookback with a 2-day recency window to diff current agent state against a baseline snapshot, surfacing changes that occurred in the trailing 48 hours. All four enrich owner identities via IdentityInfo using dual-schema compatibility (AccountUpn/AccountUPN, Timestamp/TimeGenerated) to handle both Microsoft Sentinel and Microsoft Defender schema variants.
Detection Logic
1. Instructions changed on published agent (AgentsInfoInstructionsChangedOnPublishedAgent.yaml)
- Source tables: AgentsInfo, IdentityInfo
- Logic: Compares Instructions field across current vs. baseline snapshots for agents with PublishedStatus == Published. Fires when content differs; projects SHA-256 hashes and character-length delta rather than raw instruction text.
- Entity mappings: Account (Name, UPNSuffix, AadUserId via owner resolution)
- MITRE: T1565.001 - Stored Data Manipulation
2. Newly observed MCP server on existing agent (AgentsInfoNewlyObservedMcpServer.yaml)
- Source tables: AgentsInfo, IdentityInfo
- Logic: Expands McpServers arrays in both snapshots, computes set_difference(CurrentMcpServers, BaselineMcpServers). Fires when any MCP server name appears in current state absent from the baseline.
- Entity mappings: Account (Name, UPNSuffix, AadUserId)
- MITRE: None (intentionally omitted)
3. Owner added to MCP-enabled agent (AgentsInfoOwnerAddedToMcpAgent.yaml)
- Source tables: AgentsInfo, IdentityInfo
- Logic: Scoped to agents where array_length(McpServers) > 0. Computes set_difference(CurrentOwners, PreviousOwners) and resolves added owner GUIDs to UPNs.
- Entity mappings: Account (Name, UPNSuffix, AadUserId)
- MITRE: T1098 - Account Manipulation (Persistence, Privilege Escalation)
4. Sharing expanded to organization-wide (AgentsInfoSharingExpandedToOrgWide.yaml)
- Source tables: AgentsInfo, IdentityInfo
- Logic: Surfaces agents that transitioned from restricted to org-wide sharing (SharedWith contains wildcard). Results sorted by HasElevatedCapabilities desc (MCP server count or declared tool count > 0).
- Entity mappings: Account (Name, UPNSuffix, AadUserId)
- MITRE: None (intentionally omitted)
MITRE Mapping
| Technique | Description | Query |
|---|---|---|
| T1565.001 | Stored Data Manipulation | Instructions changed on published agent |
| T1098 | Account Manipulation | Owner added to MCP-enabled agent |
Operational Notes
- Coverage window constraint: All four queries are designed to run within 2 days of a change. If your hunting cadence exceeds 48 hours, events will be missed - consider scheduling these as recurring queries.
- No bundled Analytic Rules: Hunting queries only; no scheduled Analytic Rule templates. Promotion to detection rules requires wrapping in a ScheduledAnalytics YAML.
- AgentsInfo table availability: Only populated in tenants with Microsoft 365 Copilot licensing and agent activity. Workspaces without this data source return zero results by design.
- PR discussion context: A reviewer flagged that BaselineState in the MCP server query did not exclude LifecycleStatus == Deleted records, potentially causing pre-existing MCP servers to appear as newly added. The PR author also corrected entity mapping issues (incorrect Host mapping removed; UPN fields now correctly map to Name/UPNSuffix). Verify the deleted-state exclusion is present in the final merged YAML if your environment has high agent churn.
Affected Files
Hunting Queries/AI Agents/AgentsInfoInstructionsChangedOnPublishedAgent.yaml
Hunting Queries/AI Agents/AgentsInfoNewlyObservedMcpServer.yaml
Hunting Queries/AI Agents/AgentsInfoOwnerAddedToMcpAgent.yaml
Hunting Queries/AI Agents/AgentsInfoSharingExpandedToOrgWide.yaml