Securing AI Agents From the Outside In: A Defender's Playbook for the New Privileged User

---
title: High-Risk OAuth Consent Grant to Application
tech_id: 9b2c4e71-3a8f-4d1c-b6e5-7f0a2c8d4e91
id: 9b2c4e71-3a8f-4d1c-b6e5-7f0a2c8d4e91
status: experimental
description: Detects OAuth consent grants assigning broad mail, file, or directory scopes to an application — a common path for AI agent over-permissioning and consent-phishing persistence.
references:
  - https://attack.mitre.org/techniques/T1550/001/
  - https://www.rapid7.com/blog/post/ai-inhuman-insider-threats-securing-agents
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1550.001
  - attack.persistence
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: 'Consent to application'
  filter_scopes:
    targetResources|contains:
      - 'Mail.Read'
      - 'Mail.ReadWrite'
      - 'Mail.Send'
      - 'Files.Read.All'
      - 'Files.ReadWrite.All'
      - 'Sites.Read.All'
      - 'Directory.Read.All'
      - 'offline_access'
  condition: selection and filter_scopes
falsepositives:
  - Sanctioned enterprise agent deployments — maintain an allowlist of approved app IDs and re-alert on anything outside it
level: high
---
title: Credentials Added to Existing Service Principal
id: 4f8a1d63-7c2b-4e59-a1d8-3b6f9c0e2a47
status: experimental
description: Detects addition of passwords or certificates to an existing app registration or service principal, a technique used to backdoor AI agent identities and maintain persistent API access.
references:
  - https://attack.mitre.org/techniques/T1098/001/
  - https://www.rapid7.com/blog/post/ai-inhuman-insider-threats-securing-agents
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1098.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Add service principal credentials'
      - 'Update application - Certificates and secrets management'
      - 'Add password to service principal'
falsepositives:
  - Routine secret rotation by automation — correlate with change tickets and rotation schedules
level: high
---
title: Server Workload Egress to Public LLM API Endpoints
id: 6d3e9b08-2f47-4a1c-9b52-8e1d6a0c5f73
status: experimental
description: Detects processes on server workloads initiating outbound TLS connections to public LLM provider APIs, indicating unapproved AI agent deployment (shadow AI) or agent-driven data egress.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://www.rapid7.com/blog/post/ai-inhuman-insider-threats-securing-agents
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
      - 'api.mistral.ai'
      - 'openai.azure.com'
  filter_browser:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  filter_approved_agents:
    Image|endswith:
      - '\approved-agent-host.exe'
  condition: selection and not 1 of filter_*
falsepositives:
  - Developer workstations and sanctioned copilot integrations — scope this rule to server OUs and maintain an approved-agent binary list
level: medium

let Lookback = 14d;
let Baseline = 30d;
let HighRiskScopes = dynamic(["Mail.Read","Mail.ReadWrite","Files.Read.All","Sites.Read.All","Directory.Read.All","Mail.Send"]);
// Part 1: New high-risk consent grants or credential additions in the lookback window
AuditLogs
| where TimeGenerated > ago(Lookback)
| where OperationName in~ ("Consent to application","Add service principal credentials","Update application – Certificates and secrets management")
| mv-apply TargetResource = TargetResources on (
    where TargetResource.displayName has_any (HighRiskScopes) or OperationName has "credentials"
)
| extend AppId = tostring(TargetResources[0].id),
         Actor = tostring(InitiatedBy.user.userPrincipalName),
         IPAddr = tostring(InitiatedBy.user.ipAddress)
| summarize RiskEvents = count(), Operations = make_set(OperationName) by AppId, Actor, IPAddr, bin(TimeGenerated, 1h)
| where RiskEvents >= 1
| join kind=leftouter (
    // Part 2: Baseline check — is this app historically present and active?
    SigninLogs
    | where TimeGenerated > ago(Baseline)
    | summarize HistoricalSignins = count() by AppId
) on AppId
| extend IsNewPrincipal = (HistoricalSignins < 10 or isempty(HistoricalSignins))
| project TimeGenerated, AppId, Actor, IPAddr, Operations, RiskEvents, HistoricalSignins, IsNewPrincipal
| sort by IsNewPrincipal desc, TimeGenerated desc

// Part 3: Hunt for machine-speed mailbox/file access patterns from non-human identities
let Threshold = 500;
OfficeActivity
| where TimeGenerated > ago(24h)
| where Operation in~ ("MailItemsAccessed","FileAccessed","FileDownloaded","SearchQueryPerformed")
| where UserType in ("ServicePrincipal","Application") or UserId contains "app@"
| summarize AccessCount = count(), DistinctTargets = dcount(OfficeObjectId), Workloads = make_set(OfficeWorkload)
  by UserId, ClientIP, bin(TimeGenerated, 15m)
| where AccessCount > Threshold or DistinctTargets > 100
| project TimeGenerated, UserId, ClientIP, AccessCount, DistinctTargets, Workloads
| sort by AccessCount desc

-- Hunt: processes with live connections to public LLM APIs or local agent runtimes
SELECT Pid, Ppid, Name, CommandLine, Exe, Username,
       Connections.remote_ip AS RemoteIP,
       Connections.remote_port AS RemotePort
FROM pslist()
WHERE CommandLine =~ '(?i)(openai|anthropic|langchain|autogen|crewai|llamaindex|semantic.?kernel|ollama|mcp.?server)'
   OR Exe =~ '(?i)(ollama|llama|agent|copilot)'
   OR Pid IN (
       SELECT Pid FROM netstat()
       WHERE Status =~ 'ESTABLISHED'
         AND RemotePort in (443, 11434)
         AND RemoteIP =~ '^(?!10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)'
   )

-- Hunt: agent binaries executing from user-writable or temp paths (non-standard install)
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime,
       hash(path=Exe).SHA256 AS SHA256
FROM pslist()
WHERE Exe =~ '(?i)(\\\\Users\\\\[^\\]+\\\\(AppData|Downloads|Desktop)\\\\|\\\\Temp\\\\|\\\\ProgramData\\\\)'
  AND CommandLine =~ '(?i)(python|node|agent|mcp|llm|graph|mail)'

# Requires: Microsoft.Graph PowerShell SDK, scopes: Application.Read.All, AuditLog.Read.All
# Purpose: Inventory high-risk OAuth grants and flag revocation candidates for AI-agent identities

Connect-MgGraph -Scopes "Application.Read.All","AuditLog.Read.All","Directory.Read.All" -NoWelcome

$HighRiskScopes = @("Mail.Read","Mail.ReadWrite","Mail.Send","Files.Read.All","Files.ReadWrite.All","Sites.Read.All","Directory.Read.All","ChannelMessage.Read.All")
$ReportPath = ".\AgentIdentityAudit_$(Get-Date -Format 'yyyyMMdd_HHmm').csv"

# --- 1. Enumerate all OAuth2 permission grants and match against high-risk scopes ---
$Grants = Get-MgOauth2PermissionGrant -All
$Flagged = foreach ($g in $Grants) {
    $matched = ($g.Scope -split ' ') | Where-Object { $HighRiskScopes -contains $_ }
    if ($matched) {
        $sp = Get-MgServicePrincipal -ServicePrincipalId $g.ClientId -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            AppDisplayName   = $sp.DisplayName
            AppId            = $sp.AppId
            ServicePrincipal = $g.ClientId
            ConsentType      = $g.ConsentType          # 'AllPrincipals' = tenant-wide admin consent
            RiskScopes       = ($matched -join ';')
            CreatedDateTime  = $sp.CreatedDateTime
            Action           = if ($g.ConsentType -eq 'AllPrincipals') { 'REVIEW-REVOKE-CANDIDATE' } else { 'REVIEW' }
        }
    }
}

# --- 2. Flag service principals with credentials added in the last 30 days ---
$Cutoff = (Get-Date).AddDays(-30)
$RecentCreds = foreach ($sp in (Get-MgServicePrincipal -All -Property "DisplayName,AppId,KeyCredentials,PasswordCredentials")) {
    $newKeys = @($sp.PasswordCredentials | Where-Object { $_.StartDateTime -gt $Cutoff }) +
               @($sp.KeyCredentials | Where-Object { $_.StartDateTime -gt $Cutoff })
    if ($newKeys.Count -gt 0) {
        [PSCustomObject]@{
            AppDisplayName = $sp.DisplayName
            AppId          = $sp.AppId
            NewCreds30d    = $newKeys.Count
            Action         = 'VERIFY-AGAINST-CHANGE-TICKET'
        }
    }
}

# --- 3. Output and guidance ---
$Flagged + $RecentCreds | Export-Csv -Path $ReportPath -NoTypeInformation
Write-Host "`n[*] $($Flagged.Count) high-risk consent grants | $($RecentCreds.Count) principals with recent credentials" -ForegroundColor Yellow
Write-Host "[*] Report: $ReportPath`n"
Write-Host "Revocation runbook (execute only after business-owner confirmation):" -ForegroundColor Cyan
Write-Host '  # Revoke all refresh tokens / sessions for a principal:'
Write-Host '  Revoke-MgServicePrincipalSignInSession -ServicePrincipalId <SP_ID>'
Write-Host '  # Remove a specific over-scoped grant:'
Write-Host '  Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId <GRANT_ID>'
Write-Host '  # Disable the principal entirely (kill switch):'
Write-Host '  Update-MgServicePrincipal -ServicePrincipalId <SP_ID> -AccountEnabled:$false'