NIST, CISA, and NSA: Runaway AI Agents Are Incidents — Identity Telemetry and Response Playbooks for 2026

---
title: Credential or Secret Added to Service Principal or App Registration
description: Detects addition of passwords or key credentials to Entra ID application or service principal objects — a primary authority-expansion vector for AI agent identities.
references:
  - https://www.bleepingcomputer.com/news/security/when-an-ai-agent-is-the-incident-the-identity-record-is-the-evidence/
  - https://attack.mitre.org/techniques/T1098/001/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.persistence
  - attack.t1098.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Add service principal credentials'
      - 'Update application - Certificates and secrets management'
      - 'Add app role assignment to service principal'
  condition: selection
falsepositives:
  - Legitimate DevOps credential rotation — correlate with change tickets
level: high
---
title: Long-Lived Access Key Created for IAM User
description: Detects creation of static AWS access keys, a common way agent integrations persist authority outside of short-lived role assumption.
references:
  - https://www.bleepingcomputer.com/news/security/when-an-ai-agent-is-the-incident-the-identity-record-is-the-evidence/
  - https://attack.mitre.org/techniques/T1098/001/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.persistence
  - attack.t1098.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName:
      - CreateAccessKey
      - CreateLoginProfile
      - AttachUserPolicy
  condition: selection
falsepositives:
  - Onboarding automation — alert on keys created for accounts without a matching IAC pipeline run
level: medium
---
title: Interactive Logon or Shell Spawned by AI Agent Host Process
description: Detects agent framework runtimes (python, node) spawning interactive shells or credential access tooling on endpoints — consistent with a steered or compromised local agent.
references:
  - https://www.bleepingcomputer.com/news/security/when-an-ai-agent-is-the-incident-the-identity-record-is-the-evidence/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\node.exe'
      - '\uv.exe'
      - '\npx.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\net.exe'
  condition: all of selection_*
falsepositives:
  - Developer tooling and build scripts — scope to hosts with known agent/MCP deployments
level: medium

// Hunt: Agent authority expansion followed by anomalous use
// Correlates new credentials/permissions on service principals with sign-ins from new IPs within 7 days
let credAdded = AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ("Add service principal credentials", "Update application - Certificates and secrets management", "Add app role assignment to service principal")
| extend TargetSpn = tostring(TargetResources[0].displayName)
| project CredAddedTime=TimeGenerated, TargetSpn, InitiatedBy=tostring(InitiatedBy.user.userPrincipalName), OperationName;
let spSignins = AADServicePrincipalSignInLogs
| where TimeGenerated > ago(14d)
| project SigninTime=TimeGenerated, ServicePrincipalName=tostring(ServicePrincipalName), IPAddress, AppId, ResourceDisplayName;
credAdded
| join kind=inner spSignins on $left.TargetSpn == $right.ServicePrincipalName
| where SigninTime between (CredAddedTime .. CredAddedTime + 7d)
| summarize FirstUse=min(SigninTime), DistinctIPs=dcount(IPAddress), IPs=make_set(IPAddress), Resources=make_set(ResourceDisplayName)
  by TargetSpn, InitiatedBy, OperationName
| extend KnownIP = todynamic("REPLACE_WITH_BASELINE")
| sort by FirstUse asc;
// Secondary: broad Graph scope on app registrations granted in last 30 days
AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName == "Consent to application" or OperationName == "Add app role assignment to service principal"
| mv-expand TargetResources
| mv-expand TargetResources.modifiedProperties
| where tostring(TargetResources_modmodifiedProperties.displayName) has "AppRoleAssignment"
| where tostring(TargetResources_modmodifiedProperties.newValue) has_any ("Sites.ReadWrite.All", "Mail.Read", "Files.ReadWrite.All", "Directory.ReadWrite.All", "Mail.Send")
| project TimeGenerated, OperationName, App=tostring(TargetResources.displayName), ConsentBy=tostring(InitiatedBy.user.userPrincipalName)
| sort by TimeGenerated desc

-- Hunt for AI agent credential material and tool configs on endpoints
-- Targets .env files with LLM API keys and MCP client configurations
LET keyFiles = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/.env', 'C:/Users/*/.claude*', 'C:/Users/*/.config/**/*mcp*', 'C:/Users/*/AppData/Roaming/Claude/*', 'C:/Users/*/*mcp*.json'])

LET agentProcs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(mcp|langchain|autogen|openai|anthropic|agent)'
  AND Name =~ '(?i)(python|node|uv|npx)'

SELECT 'agent_process' AS ArtifactType, Name AS Detail1, CommandLine AS Detail2, Username AS Detail3, CreateTime AS Timestamp FROM agentProcs
UNION ALL
SELECT 'credential_file' AS ArtifactType, FullPath AS Detail1, format('%v bytes', Size) AS Detail2, '' AS Detail3, Mtime AS Timestamp FROM keyFiles

#Requires -Modules Microsoft.Graph.Identity.Applications, Microsoft.Graph.Identity.SignIns
# Audit Entra ID for over-privileged and freshly-credentialed agent identities
# Run as a scheduled task with an audit identity holding Application.Read.All, AuditLog.Read.All

Connect-MgGraph -Scopes "Application.Read.All","AuditLog.Read.All","Directory.Read.All" -NoWelcome

$report = @()
$highRiskScopes = @('Sites.ReadWrite.All','Mail.Read','Mail.Send','Files.ReadWrite.All','Directory.ReadWrite.All','Application.ReadWrite.All')
$cutoff = (Get-Date).AddDays(-30)

# 1. Service principals with credentials added in the last 30 days
Get-MgServicePrincipal -All | ForEach-Object {
    $sp = $_
    $sp.PasswordCredentials | Where-Object { $_.StartDateTime -gt $cutoff } | ForEach-Object {
        $report += [pscustomobject]@{
            Finding = 'RecentPasswordCredential'; DisplayName = $sp.DisplayName
            ObjectId = $sp.Id; Detail = "Secret created $($_.StartDateTime)"; Severity = 'High'
        }
    }
    $sp.KeyCredentials | Where-Object { $_.StartDateTime -gt $cutoff } | ForEach-Object {
        $report += [pscustomobject]@{
            Finding = 'RecentKeyCredential'; DisplayName = $sp.DisplayName
            ObjectId = $sp.Id; Detail = "Cert added $($_.StartDateTime)"; Severity = 'Medium'
        }
    }
}

# 2. App role assignments carrying high-risk Graph scopes
Get-MgServicePrincipal -All | ForEach-Object {
    $sp = $_
    Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All | ForEach-Object {
        $report += [pscustomobject]@{
            Finding = 'AppRoleAssignment'; DisplayName = $sp.DisplayName
            ObjectId = $sp.Id; Detail = $_.AppRoleId; Severity = 'Review'
        }
    }
}

$report | Sort-Object Severity, DisplayName | Format-Table -AutoSize
$report | Export-Csv -Path ".\AgentIdentityAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "`nReview every 'High' finding against a change record. No ticket = treat as unauthorized authority expansion."