KQL Search

let injectionMarkers = dynamic([
    "ignore previous instructions","disregard previous","you are now",
    "developer mode","do anything now","reveal your system prompt",
    "bypass your rules","forget the previous","new instructions",
    "from now on you","store this and remember","next time the user asks"
]);
let sensitiveConnectors = dynamic([
    "office365","sendemail","sendmail","outlook","exchange",
    "http","webhook","azuread","azure","sql","dataverse",
    "sharepoint","onedrive","powershell","function","automate",
    "logicapp","graph","keyvault","blob","storage"
]);
let safeHostSuffixes = dynamic([
    "microsoft.com","office.com","office365.com","sharepoint.com",
    "microsoftonline.com","windows.net","azure.com","azureedge.net",
    "live.com","bing.com","msn.com","dynamics.com","powerplatform.com"
]);
let turns =
    AppEvents
    | where TimeGenerated > ago(2h)
    | where Name == "BotMessageReceived"
    | extend ConvId = tostring(Properties["conversationId"]),
             Text   = tolower(tostring(Properties["text"])),
             ChannelId = tostring(Properties["channelId"])
    | where isnotempty(Text);
let convBounds =
    turns
    | summarize Turns = count(),
                Start = min(TimeGenerated),
                End   = max(TimeGenerated),
                AnyUser = take_any(UserId),
                AnyIp   = take_any(ClientIP),
                AnyChannel = take_any(ChannelId)
            by ConvId
    | where Turns >= 5;
let early =
    turns
    | join kind=inner convBounds on ConvId
    | extend RangeMs = max_of(datetime_diff('millisecond', End, Start), 1)
    | extend OffMs   = datetime_diff('millisecond', TimeGenerated, Start)
    | extend Quartile = min_of(toint(OffMs * 4 / RangeMs), 3)
    | where Quartile == 0
    | extend Host = tolower(extract(@"https?://([A-Za-z0-9.\-]+)", 1, Text))
    | extend HasInjection = Text has_any (injectionMarkers);
let earlyUrl =
    early
    | where isnotempty(Host)
    | where not(Host has_any (safeHostSuffixes))
    | summarize UrlHits = count(), UntrustedHosts = make_set(Host, 16) by ConvId;
let earlyInj =
    early
    | summarize InjHits = countif(HasInjection) by ConvId;
let lateActs =
    AppDependencies
    | where TimeGenerated > ago(2h)
    | where AppRoleName == "Microsoft Copilot Studio" or DependencyType == "Connector"
    | extend ConvId   = tostring(Properties["conversationId"]),
             MatchKey = tolower(strcat(Name, " ", Target))
    | where MatchKey has_any (sensitiveConnectors)
    | summarize SensitiveCalls  = count(),
                Connectors      = make_set(Name, 8),
                Targets         = make_set(Target, 16),
                LastSeen        = max(TimeGenerated),
                FirstSensitive  = min(TimeGenerated)
            by ConvId;
earlyUrl
| join kind=fullouter earlyInj on ConvId
| extend ConvId = coalesce(ConvId, ConvId1)
| extend Contamination = coalesce(UrlHits, 0) + coalesce(InjHits, 0)
| where Contamination >= 1
| join kind=inner lateActs on ConvId
| join kind=leftouter convBounds on ConvId
| where SensitiveCalls >= 1
| extend AccountName = iff(isempty(AnyUser), "unknown-agent", AnyUser)
| project LastSeen, AccountName, UserId = AnyUser, ConvId, AnyChannel, AnyIp,
          Contamination, UntrustedHosts, SensitiveCalls, Connectors, Targets, FirstSensitive
| order by Contamination desc, SensitiveCalls desc