Microsoft Project Perception and Guardian Agents: A Defender's Guide to Containing AI Agents as Insider Threats

---
title: AI Agent Runtime Spawning Interactive Shell or Script Interpreter
id: 3f8a2c71-6b9d-4e15-a2c7-9d1e5f8b3a06
status: experimental
description: Detects common AI agent runtimes (Python, Node, Semantic Kernel hosts) spawning cmd.exe, powershell.exe, or bash. Tool-using agents that suddenly invoke interactive shells are a strong indicator of prompt injection-driven command execution or compromised MCP tooling.
references:
  - https://www.darkreading.com/cybersecurity-operations/ai-agents-insider-threats-inside-microsoft-unified-security-stack
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
      - '\dotnet.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  filter_automation:
    CommandLine|contains:
      - 'pip install'
      - 'npm install'
      - '--version'
  condition: selection_parent and selection_child and not filter_automation
falsepositives:
  - Agent frameworks legitimately invoking local tools (build an allowlist per approved MCP tool)
  - Development workstations running agent prototypes
level: high
---
title: AI Agent Runtime Spawning Shell on Linux Hosts
id: 8c4e1b92-2d7a-4f38-b6e1-4a9c3d7e5f21
status: experimental
description: Detects Python or Node agent runtimes spawning bash/sh on Linux. An autonomous agent dropping to a shell is consistent with indirect prompt injection escalating from tool invocation to host-level command execution.
references:
  - https://www.darkreading.com/cybersecurity-operations/ai-agents-insider-threats-inside-microsoft-unified-security-stack
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/node'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate agent toolchains (shell tools registered via MCP) — baseline per host and tune
level: high
---
title: Service Principal Credential or Secret Added to Existing App Registration
id: 1b7d4e63-9f2c-4a81-8d35-6e2b9c4f7a18
status: experimental
description: Detects new secrets or certificates added to existing Entra ID app registrations. Attackers targeting AI agent infrastructure add credentials to agent service principals to gain persistent, token-based access that survives containment of the agent runtime itself.
references:
  - https://www.darkreading.com/cybersecurity-operations/ai-agents-insider-threats-inside-microsoft-unified-security-stack
  - https://attack.mitre.org/techniques/T1098/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1098.001
logsource:
  service: auditlogs
  product: azure
detection:
  selection:
    OperationName:
      - 'Update application – Certificates and secrets management'
      - 'Add service principal credentials'
  condition: selection
falsepositives:
  - Routine certificate rotation by app owners — correlate with change tickets
level: high

// Hunt: Anomalous spike in Graph API activity by AI agent service principals
// Rogue or manipulated agents exhibit sudden call-volume surges and first-seen resource access.
// Tune the baseline window and multiplier to your environment.
let baseline_start = ago(14d);
let baseline_end = ago(1d);
let baseline = AADServicePrincipalSignInLogs
| where TimeGenerated between (baseline_start .. baseline_end)
| summarize DailyCalls = count() by ServicePrincipalId, bin(TimeGenerated, 1d)
| summarize AvgCalls = avg(DailyCalls) by ServicePrincipalId;
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(1d)
| summarize TodayCalls = count(),
  UniqueResources = dcount(ResourceDisplayName),
  Resources = make_set(ResourceDisplayName, 20),
  IPs = make_set(IPAddress, 10)
  by ServicePrincipalId, ServicePrincipalDisplayName
| join kind=inner baseline on ServicePrincipalId
| where TodayCalls > (AvgCalls * 5) and TodayCalls > 500
| project ServicePrincipalDisplayName, TodayCalls, AvgCalls, UniqueResources, Resources, IPs
| order by TodayCalls desc;

// Hunt: Agent service principals accessing first-seen sensitive resources
// Flags an agent identity touching Mail, SharePoint, or Directory scopes it has never used before.
let lookback = 30d;
let recent = 24h;
let historical = AADServicePrincipalSignInLogs
| where TimeGenerated between (ago(lookback) .. ago(recent))
| summarize by ServicePrincipalId, ResourceDisplayName;
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(recent)
| where ResourceDisplayName has_any ("Microsoft Graph", "Office 365 Exchange Online", "SharePoint")
| summarize FirstSeenResource = min(TimeGenerated), AppId = any(AppId)
  by ServicePrincipalId, ServicePrincipalDisplayName, ResourceDisplayName
| where historical !contains (ServicePrincipalId, ResourceDisplayName)
| order by FirstSeenResource desc;

// Hunt: Endpoint telemetry — agent runtimes spawning shells (complements Sigma rule 1)
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("python.exe", "pythonw.exe", "node.exe", "dotnet.exe", "python3", "python", "node")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh", "curl", "wget")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
  FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

-- Artifact: Windows.Hunt.AIAgentRuntimeExposure
-- Hunt for agent runtimes (python/node) with established network connections
-- or shell-spawning behavior across the fleet. Scope by label group for agent hosts.

LET runtime_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(python|pythonw|node|dotnet)\.exe$'
  AND CommandLine !~ '(?i)pip install|npm install'

LET runtime_conns = SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status = 'ESTABLISHED'
  AND Name =~ '(?i)(python|pythonw|node|dotnet)\.exe$'

SELECT * FROM runtime_procs
UNION ALL
SELECT Pid, NULL AS Ppid, Name, NULL AS CommandLine,
       format(format='%v:%v', args=[RemoteAddress, RemotePort]) AS Exe,
       Status AS Username, NULL AS CreateTime
FROM runtime_conns

# AI Agent Identity Hygiene Audit — run with an account holding Application.Read.All + AuditLog.Read.All
# Requires: Microsoft.Graph PowerShell SDK
Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All","AuditLog.Read.All" -NoWelcome

# 1. Enumerate app registrations (candidate agent identities) with high-risk Graph permissions
$riskyScopes = 'Mail.Read','Mail.ReadWrite','Mail.Send','Files.Read.All','Files.ReadWrite.All',
               'Directory.Read.All','Directory.ReadWrite.All','Sites.FullControl.All'
$apps = Get-MgApplication -All -Property Id,DisplayName,RequiredResourceAccess,CreatedDateTime,Owners
$report = foreach ($app in $apps) {
    $grants = $app.RequiredResourceAccess.ResourceAccess | Where-Object { $riskyScopes -contains $_.Id -or $_.Type -eq 'Role' }
    $owners = (Get-MgApplicationOwner -ApplicationId $app.Id -ErrorAction SilentlyContinue)
    if ($grants -or -not $owners) {
        [PSCustomObject]@{
            DisplayName     = $app.DisplayName
            AppId           = $app.AppId
            Created         = $app.CreatedDateTime
            HasOwners       = [bool]$owners
            DelegatedGrants = ($grants | Measure-Object).Count
        }
    }
}
$report | Export-Csv -Path ".\agent-identity-audit-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
$report | Format-Table -AutoSize

# 2. Identify service principals with credentials older than 180 days (rotate these)
$sps = Get-MgServicePrincipal -All -Property Id,DisplayName,PasswordCredentials,KeyCredentials
foreach ($sp in $sps) {
    $stale = $sp.PasswordCredentials | Where-Object { $_.StartDateTime -lt (Get-Date).AddDays(-180) }
    if ($stale) { Write-Warning "$($sp.DisplayName): secret older than 180 days — rotate and scope down permissions" }
}

# 3. Quick win: remove an over-privileged app role assignment once identified
# Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId <sp-object-id>
# Remove-MgServicePrincipalAppRoleAssignment -ServicePrincipalId <sp-object-id> -AppRoleAssignmentId <assignment-id>