KQL Search

id: 0fd18219-8fc2-90d3-e2c4-516f8291a1b6
name: Microsoft 365 Copilot - API misuse / automation abuse from AI agent
description: |
  Detects A Microsoft 365 Copilot agent that, within a 1-hour window, drives
  an unusually high volume of downstream API or tool calls with a
  high client-error (4xx) or server-error (5xx) rate. This is the
  signature of a runaway agent loop, automation abuse, or a
  brute-force-style API misuse driven by a compromised agent.

  Threshold defaults: at least 200 calls in the window AND error
  rate at or above 30 percent. Tune via the "MinCalls" and
  "ErrorRateThreshold" let statements at the top of the query.
severity: Medium
requiredDataConnectors:
- connectorId: MicrosoftCopilot
  dataTypes:
  - CopilotActivity
queryFrequency: PT1H
queryPeriod: PT1H
triggerOperator: gt
triggerThreshold: 0
enabled: true
tactics:
- Impact
relevantTechniques:
- T1499
query: |
  let MinCalls = 200;
  let ErrorRateThreshold = 0.30;
  CopilotActivity
  | where TimeGenerated > ago(1h)
  | extend
      ToolName = tostring(LLMEventData.ToolName),
      HttpStatus = toint(LLMEventData.HttpStatus),
      ApiTarget = tostring(LLMEventData.ApiTarget)
  | where isnotempty(ToolName) or isnotempty(ApiTarget)
  | summarize
      TotalCalls = count(),
      ClientErrors = countif(HttpStatus between (400 .. 499)),
      ServerErrors = countif(HttpStatus between (500 .. 599)),
      Tools = make_set(ToolName, 32),
      ApiTargets = make_set(ApiTarget, 32),
      ClientIPs = make_set(SrcIpAddr, 16),
      FirstSeen = min(TimeGenerated),
      LastSeen = max(TimeGenerated)
      by AgentId, AgentName, ActorName, TenantId
  | extend ErrorRate = todouble(ClientErrors + ServerErrors) / todouble(TotalCalls)
  | where TotalCalls >= MinCalls and ErrorRate >= ErrorRateThreshold
  | extend SrcIpAddr = tostring(ClientIPs[0])
entityMappings:
- entityType: CloudApplication
  fieldMappings:
  - identifier: Name
    columnName: AgentName
  - identifier: AppId
    columnName: AgentId
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: ActorName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
eventGroupingSettings:
  aggregationKind: SingleAlert
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT6H
    matchingMethod: Selected
    groupByEntities:
    - CloudApplication
    groupByAlertDetails: []
    groupByCustomDetails: []
version: 1.0.0
kind: Scheduled
tags:
- Sentinel-As-Code
- Custom
- Copilot
- AI