Autonomous AI Agents Acting as You: Defending Against Agentic AI Impersonation and Over-Delegated Authority

---
title: AI Agent Runtime Accessing Token or Credential Files
id: 3f8c2a71-6d4b-4e19-a7c2-9b5e1d0f8a34
status: experimental
description: Detects scripting runtimes commonly used for agentic AI frameworks (Python, Node) reading credential stores, token caches, or environment files that typically hold API/OAuth tokens for autonomous agents.
references:
  - https://attack.mitre.org/techniques/T1552/001/
  - https://simonwillison.net/2026/Sep/28/muse-ai-agent/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
  selection_target:
    TargetFilename|contains:
      - '\.env'
      - 'credentials.json'
      - 'token.json'
      - 'oauth'
      - '\.config\gcloud\'
      - '\.azure\'
      - 'msal_token_cache'
  condition: selection_process and selection_target
falsepositives:
  - Developers running local tooling that legitimately reads cloud CLI token caches
  - Approved internal automation with documented service accounts
level: medium
---
title: Scripting Runtime Outbound Connection to Messaging or Mail API
id: 8b1e5d42-2c7a-4f83-b9e6-4a0d7c3f1295
status: experimental
description: Detects Python, Node, or PowerShell processes establishing outbound HTTPS connections to SaaS mail/messaging API endpoints — consistent with an autonomous agent sending messages under a delegated identity rather than a user-driven client.
references:
  - https://attack.mitre.org/techniques/T1071.001/
  - https://simonwillison.net/2026/Sep/28/muse-ai-agent/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_dest:
    DestinationHostname|contains:
      - 'graph.microsoft.com'
      - 'slack.com/api'
      - 'gmail.googleapis.com'
      - 'api.twilio.com'
      - 'graph.facebook.com'
    DestinationPort: 443
  condition: selection_process and selection_dest
falsepositives:
  - Approved IT automation scripts (inventory by process path and hash)
  - Legitimate developer testing against SaaS APIs
level: medium
---
title: Headless Browser Automation Launched by Scripting Runtime
id: c4d9f206-81b3-4a57-9e2d-6f1a8b5c7309
status: experimental
description: Detects Python or Node spawning headless Chrome/Chromium — a common pattern for AI agents driving web UIs (marketplaces, webmail, internal portals) to act as a user where no API exists.
references:
  - https://attack.mitre.org/techniques/T1185/
  - https://simonwillison.net/2026/Sep/28/muse-ai-agent/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1185
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\chrome.exe'
      - '\chromium.exe'
      - '\msedge.exe'
    CommandLine|contains:
      - '--headless'
      - '--remote-debugging-port'
  condition: selection_parent and selection_child
falsepositives:
  - QA/test automation pipelines (Selenium, Playwright, Puppeteer) on build agents
level: low

// Hunt for delegated/application mail sends characteristic of autonomous agents
// Requires Microsoft 365 Unified Audit Log ingestion into Sentinel
let AgentLikePattern = dynamic(["SendAs", "SendOnBehalf", "sendMail"]);
union isfuzzy=true
    (OfficeActivity
    | where OfficeWorkload == "Exchange"
    | where Operation in~ ("Send")
    | extend AppId = tostring(parse_json(ExtendedProperties)),
    (AuditLogs
    | where OperationName has_any (AgentLikePattern))
| where TimeGenerated > ago(7d)
| summarize SendCount = count(),
            DistinctRecipients = dcount(tostring(RecipientSet)),
            FirstSend = min(TimeGenerated),
            LastSend = max(TimeGenerated)
    by UserId = coalesce(UserId, tostring(InitiatedBy)), bin(TimeGenerated, 1h)
// Machine-cadence heuristic: >20 sends/hour from a single identity is rarely human
| where SendCount > 20
| project TimeGenerated, UserId, SendCount, DistinctRecipients, FirstSend, LastSend
| order by SendCount desc;

// Companion hunt: endpoints where scripting runtimes talk to SaaS messaging APIs
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("python.exe", "pythonw.exe", "node.exe", "powershell.exe", "pwsh.exe")
| where RemoteUrl has_any ("graph.microsoft.com", "slack.com", "gmail.googleapis.com", "api.twilio.com")
| summarize Connections = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            DistinctRemoteUrls = dcount(RemoteUrl)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Connections desc;

-- Artifact: Windows.Artifact.AIAgentFootprintHunt
-- Locate agentic AI runtime processes and their token/config artifacts on endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(python|node|pwsh)'
  AND CommandLine =~ '(?i)(agent|autogen|langchain|crewai|openai|anthropic|llm|selenium|playwright|puppeteer)'

-- Companion: enumerate likely token/env files holding agent credentials
SELECT FullPath, Size, Mtime
FROM glob(globs=['C:\\Users\\*\\**\\.env',
                 'C:\\Users\\*\\**\\token.json',
                 'C:\\Users\\*\\**\\credentials.json'],
          accessor='ntfs')
WHERE Mtime > now() - 604800

# Audit-and-report: find OAuth grants giving agents mail/chat write capability
# Requires: Microsoft.Graph PowerShell SDK, run as Global Reader or higher
Connect-MgGraph -Scopes "Directory.Read.All","DelegatedPermissionGrant.Read.All"

$riskyScopes = @("Mail.Send","Mail.ReadWrite","Chat.ReadWrite","ChatMessage.Send","ChannelMessage.Send")
$report = @()

Get-MgOauth2PermissionGrant -All | ForEach-Object {
    $grant = $_
    $scopes = $grant.Scope -split ' '
    $hit = $scopes | Where-Object { $riskyScopes -contains $_ }
    if ($hit) {
        $sp = Get-MgServicePrincipal -ServicePrincipalId $grant.ClientId
        $report += [PSCustomObject]@{
            AppName      = $sp.DisplayName
            AppId        = $sp.AppId
            ConsentType  = $grant.ConsentType   # AllPrincipals = org-wide consent
            RiskyScopes  = ($hit -join ',')
            GrantId      = $grant.Id
        }
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\agent-oauth-audit-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# To revoke a specific grant after review (do NOT bulk-revoke without validation):
# Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId <GrantId>