AI Agents - Owner added to MCP-enabled agent

Hunt Hypothesis

This hunt targets adversaries leveraging MITRE technique T1098 to establish persistence by adding unauthorized owners to existing AI agents with MCP servers, effectively creating a new privileged access vector for lateral movement or data exfiltration. Proactive hunting in Azure Sentinel is critical because the medium severity of this event requires rapid validation within 48 hours to distinguish legitimate administrative changes from stealthy account manipulation before attackers can fully exploit these newly granted privileges.

KQL Query

let lookback = 14d;
let recent = 2d;
let IdentityIdtoUPN = materialize(
    IdentityInfo
    | extend ResolvedAccountUpn = tostring(column_ifexists("AccountUpn", column_ifexists("AccountUPN", ""))),
             IdentityTimestamp = todatetime(column_ifexists("Timestamp", column_ifexists("TimeGenerated", datetime(null))))
    | where IdentityTimestamp >= ago(lookback)
    | where isnotempty(AccountObjectId) and isnotempty(ResolvedAccountUpn)
    | summarize arg_max(IdentityTimestamp, ResolvedAccountUpn) by AccountObjectId
    | project AccountObjectId = tostring(AccountObjectId), AccountUpn = ResolvedAccountUpn);
let CurrentState = materialize(
    AgentsInfo
    | where Timestamp > ago(recent)
    | summarize arg_max(Timestamp, *) by AgentId
    | where LifecycleStatus != "Deleted"
    | where array_length(coalesce(McpServers, dynamic([]))) > 0
    | project AgentId, Timestamp, Name, Platform, CreatedDateTime,
              CurrentOwners = coalesce(Owners, dynamic([])), McpServers);
let CurrentMcp =
    CurrentState
    | mv-expand Mcp = McpServers
    | extend McpName = tostring(Mcp.name)
    | summarize McpServersConfigured = make_set_if(McpName, isnotempty(McpName)) by AgentId;
let BaselineState =
    AgentsInfo
    | where Timestamp between (ago(lookback) .. ago(recent))
    | where LifecycleStatus != "Deleted"
    | summarize arg_max(Timestamp, *) by AgentId
    | project AgentId, PreviousTimestamp = Timestamp,
              PreviousOwners = coalesce(Owners, dynamic([]));
CurrentState
| join kind=inner CurrentMcp on AgentId
| join kind=inner BaselineState on AgentId
| extend AddedOwners = set_difference(CurrentOwners, PreviousOwners)
| where array_length(AddedOwners) > 0
| mv-expand AddedOwnerId = AddedOwners to typeof(string)
| join kind=leftouter IdentityIdtoUPN on $left.AddedOwnerId == $right.AccountObjectId
| extend AddedOwnerUpn = AccountUpn,
         UnresolvedAddedOwnerId = iff(isempty(AccountUpn), AddedOwnerId, "")
| extend AddedOwnerAccountName = tostring(split(AddedOwnerUpn, "@")[0]),
         AddedOwnerAccountUPNSuffix = tostring(split(AddedOwnerUpn, "@")[1])
| project Timestamp, PreviousTimestamp, AgentId, Name, Platform, CreatedDateTime,
         PreviousOwners, CurrentOwners, AddedOwners, AddedOwnerId,
         UnresolvedAddedOwnerId, AddedOwnerUpn, AddedOwnerAccountName,
         AddedOwnerAccountUPNSuffix, McpServersConfigured
| sort by Timestamp desc

Analytic Rule Definition

id: c35b5a60-71ee-448c-935d-f60f4a4c7f2b
name: AI Agents - Owner added to MCP-enabled agent
description: |
  Identifies owners newly observed on existing AI agents with MCP servers configured. Review the added owners and audit records to confirm whether privileged access was authorized. Run within 2 days of a change to retain coverage.
requiredDataConnectors: []
tactics:
  - Persistence
  - PrivilegeEscalation
relevantTechniques:
  - T1098
query: |
  let lookback = 14d;
  let recent = 2d;
  let IdentityIdtoUPN = materialize(
      IdentityInfo
      | extend ResolvedAccountUpn = tostring(column_ifexists("AccountUpn", column_ifexists("AccountUPN", ""))),
               IdentityTimestamp = todatetime(column_ifexists("Timestamp", column_ifexists("TimeGenerated", datetime(null))))
      | where IdentityTimestamp >= ago(lookback)
      | where isnotempty(AccountObjectId) and isnotempty(ResolvedAccountUpn)
      | summarize arg_max(IdentityTimestamp, ResolvedAccountUpn) by AccountObjectId
      | project AccountObjectId = tostring(AccountObjectId), AccountUpn = ResolvedAccountUpn);
  let CurrentState = materialize(
      AgentsInfo
      | where Timestamp > ago(recent)
      | summarize arg_max(Timestamp, *) by AgentId
      | where LifecycleStatus != "Deleted"
      | where array_length(coalesce(McpServers, dynamic([]))) > 0
      | project AgentId, Timestamp, Name, Platform, CreatedDateTime,
                CurrentOwners = coalesce(Owners, dynamic([])), McpServers);
  let CurrentMcp =
      CurrentState
      | mv-expand Mcp = McpServers
      | extend McpName = tostring(Mcp.name)
      | summarize McpServersConfigured = make_set_if(McpName, isnotempty(McpName)) by AgentId;
  let BaselineState =
      AgentsInfo
      | where Timestamp between (ago(lookback) .. ago(recent))
      | where LifecycleStatus != "Deleted"
      | summarize arg_max(Timestamp, *) by AgentId
      | project AgentId, PreviousTimestamp = Timestamp,
                PreviousOwners = coalesce(Owners, dynamic([]));
  CurrentState
  | join kind=inner CurrentMcp on AgentId
  | join kind=inner BaselineState on AgentId
  | extend AddedOwners = set_difference(CurrentOwners, PreviousOwners)
  | where array_length(AddedOwners) > 0
  | mv-expand AddedOwnerId = AddedOwners to typeof(string)
  | join kind=leftouter IdentityIdtoUPN on $left.AddedOwnerId == $right.AccountObjectId
  | extend AddedOwnerUpn = AccountUpn,
           UnresolvedAddedOwnerId = iff(isempty(AccountUpn), AddedOwnerId, "")
  | extend AddedOwnerAccountName = tostring(split(AddedOwnerUpn, "@")[0]),
           AddedOwnerAccountUPNSuffix = tostring(split(AddedOwnerUpn, "@")[1])
  | project Timestamp, PreviousTimestamp, AgentId, Name, Platform, CreatedDateTime,
           PreviousOwners, CurrentOwners, AddedOwners, AddedOwnerId,
           UnresolvedAddedOwnerId, AddedOwnerUpn, AddedOwnerAccountName,
           AddedOwnerAccountUPNSuffix, McpServersConfigured
  | sort by Timestamp desc
entityMappings:
  - entityType: Account

Required Data Sources

Sentinel Table	Notes
`IdentityInfo`	Ensure this data connector is enabled

MITRE ATT&CK Context

Tactic: Persistence
Tactic: PrivilegeEscalation
Technique: T1098 — T1098

References

[Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/AI Agents/AgentsInfoOwnerAddedToMcpAgent.yaml)

False Positive Guidance

Here are four specific false positive scenarios for the AI Agents - Owner added to MCP-enabled agent rule, including suggested filters and exclusions:

Scheduled Quarterly Access Review Job
- Scenario: The Identity Governance tool (e.g., SailPoint or Okta) automatically runs a scheduled job on the first Monday of every quarter. This job adds the “Security Compliance Team” distribution list as an owner to all MCP-enabled AI agents (such as those running LangChain or LlamaIndex frameworks) to facilitate automated audit logging and policy enforcement reviews.
- Filter/Exclusion: Exclude events where the source_user is a known service account (e.g., svc-identity-governance) AND the event occurs between 02:00–04:00 UTC on the first Monday of Q1, Q2, Q3, and Q4.
Onboarding of New AI Platform Administrators
- Scenario: A new Senior Data Scientist joins the organization and is provisioned with elevated privileges via an HR-triggered workflow in Workday. As part of their onboarding script, they are automatically granted “Owner” status on the company’s shared MCP-enabled Jira AI Copilot agent to allow them to configure custom model parameters and manage data connectors.
- Filter/Exclusion: Exclude events where the added_owner user account has an account_age of less than 7 days AND the action is tagged with a specific workflow ID (e.g., WF-ONBOARD-DS-01) originating from the HR integration service.
Emergency Incident Response Escalation
- Scenario: During a critical security incident, the ServiceNow ITSM platform triggers an automated escalation script that temporarily adds the “Incident Commander” (a specific high