MCP Attack Detection — Sentinel Research Lab

Sentinel detection research for MCP (Model Context Protocol) attack patterns: unusual identity access after an MCP-related event, tool-definition mutation, cross-resource access, and possible post-exploitation behavior. The rules map to the OWASP Top 10 for Agentic Applications (2026).

Publication status: this repository does not currently have a published Nine Lives companion article and is intentionally not listed in the website's Labs catalog. It remains a standalone research fixture.

The CVE-2026-26118 rule is a behavior-based heuristic informed by the Azure MCP Server SSRF disclosure. It does not prove that the CVE was exploited or that a token was stolen. Microsoft describes the issue as SSRF that can let an authorized network attacker elevate privilege; affected package ranges and the vendor advisory are recorded by NIST NVD.

What Gets Deployed

Resource	Type	OWASP Agentic
LAB - MCP SSRF-Informed Identity Access Anomaly (CVE-2026-26118)	Behavioral analytics rule (High)	ASI03
LAB - MCP Tool Definition Mutation (Rug Pull Detection)	Analytics Rule (High)	ASI01, ASI04
LAB - MCP Cross-Server Data Exfiltration Pattern	Analytics Rule (Medium)	ASI02, ASI03
LAB - Anomalous MCP Tool Invocation Spike	Analytics Rule (Medium)	ASI02
LAB - MCP Identity Post-Exploitation Chain	Analytics Rule (High)	ASI03
MCP Attack Detection — Security Posture	Workbook	All
7 hunting queries	KQL (manual)	ASI01–ASI07

MITRE ATT&CK Coverage

Technique	ID	Rule / Query
Valid Accounts: Cloud	T1078.004	Identity Access Anomaly, Post-Exploitation Chain
Adversary-in-the-Middle	T1557	Context for Inter-Agent Communications hunt; the query itself detects conditional-access gaps, not interception
Supply Chain Compromise	T1195.002	Tool Definition Mutation, Supply Chain
Data from Cloud Storage	T1530	Cross-Server Exfiltration
Unsecured Credentials	T1552	Cross-Server Exfiltration, Post-Exploitation
Cloud API	T1059.009	Invocation Spike, Code Execution
Serverless Execution	T1648	Code Execution
Stored Data Manipulation	T1565.001	Memory & Context Poisoning

Quick Start

# Review the exact plan. This performs no mutations.
./scripts/Deploy-Lab.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab" `
    -WhatIf

# Deploy analytics rules (disabled), hunting queries, and workbook.
./scripts/Deploy-Lab.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab"

# After reviewing the queries, opt in to enabling the rules.
./scripts/Deploy-Lab.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab" `
    -EnableRules

# Validate the exact manifest-owned deployment.
./scripts/Test-MCPDetections.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab"

Prerequisites

Azure subscription with Microsoft Sentinel enabled
Entra ID diagnostic settings: AuditLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs
Azure Activity Log connector enabled in Sentinel
PowerShell 7.0+ with Azure CLI
Roles sufficient to manage Sentinel analytics rules, Log Analytics saved searches, and workbooks in the target resource group. Use the narrowest tenant-specific role assignments that satisfy those operations.

Safety and ownership model

All rule and workbook IDs are deterministic and scoped to the exact workspace.
Deployment writes an owner-only .mcp-attack-detection-state.json manifest before the first cloud mutation.
Existing resources are preflighted before any write. The script refuses same-ID resources without the expected provenance and never adopts them without its manifest.
Analytics rules are deployed disabled unless -EnableRules is explicitly supplied.
-WhatIf performs the same reads and collision checks with zero writes.
Cleanup uses only exact IDs from the manifest, validates provenance again, and never searches by display-name prefix, category, or substring.
Deployments made with an older version of this repository are not automatically adopted or deleted. Inventory those resources manually before using this version.

Data Sources

Table	Purpose
`AADManagedIdentitySignInLogs`	Research unusual MCP-named managed-identity access patterns
`AADServicePrincipalSignInLogs`	Monitor MCP service principal authentication patterns
`AzureActivity`	Track MCP resource operations, deployments, configuration changes

Cleanup

./scripts/Deploy-Lab.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab" `
    -Destroy

Run the same command with -WhatIf first to preview the exact deletions. Cleanup fails closed if the manifest is absent, points to another subscription/workspace, or any resource no longer carries this lab's provenance.

Evidence boundary

These queries are research starting points. They rely on naming heuristics and on tenant-specific Entra and Azure Activity schemas. Validate table availability, field names, baselines, allowlists, query cost, and false-positive behavior in a non-production workspace before enabling them. They provide suspicious-behavior evidence, not exploit attribution.

References

License

MIT

mcp-attack-detection-sentinel — Updated!

Categories