MCP Attack Detection — Sentinel Research Lab

Sentinel detection research for MCP (Model Context Protocol) attack patterns: unusual identity access after an MCP-related event, tool-definition mutation, cross-resource access, and possible post-exploitation behavior. The rules map to the OWASP Top 10 for Agentic Applications (2026).

Publication status: this repository does not currently have a published Nine Lives companion article and is intentionally not listed in the website's Labs catalog. It remains a standalone research fixture.

The CVE-2026-26118 rule is a behavior-based heuristic informed by the Azure MCP Server SSRF disclosure. It does not prove that the CVE was exploited or that a token was stolen. Microsoft describes the issue as SSRF that can let an authorized network attacker elevate privilege; affected package ranges and the vendor advisory are recorded by NIST NVD.

What Gets Deployed

MITRE ATT&CK Coverage

Quick Start

# Review the exact plan. This performs no mutations.
./scripts/Deploy-Lab.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab" `
    -WhatIf

# Deploy analytics rules (disabled), hunting queries, and workbook.
./scripts/Deploy-Lab.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab"

# After reviewing the queries, opt in to enabling the rules.
./scripts/Deploy-Lab.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab" `
    -EnableRules

# Validate the exact manifest-owned deployment.
./scripts/Test-MCPDetections.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab"

Prerequisites

• Azure subscription with Microsoft Sentinel enabled
• Entra ID diagnostic settings: AuditLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs
• Azure Activity Log connector enabled in Sentinel
• PowerShell 7.0+ with Azure CLI
• Roles sufficient to manage Sentinel analytics rules, Log Analytics saved searches, and workbooks in the target resource group. Use the narrowest tenant-specific role assignments that satisfy those operations.

Safety and ownership model

• All rule and workbook IDs are deterministic and scoped to the exact workspace.
• Deployment writes an owner-only .mcp-attack-detection-state.json manifest before the first cloud mutation.
• Existing resources are preflighted before any write. The script refuses same-ID resources without the expected provenance and never adopts them without its manifest.
• Analytics rules are deployed disabled unless -EnableRules is explicitly supplied.
• -WhatIf performs the same reads and collision checks with zero writes.
• Cleanup uses only exact IDs from the manifest, validates provenance again, and never searches by display-name prefix, category, or substring.
• Deployments made with an older version of this repository are not automatically adopted or deleted. Inventory those resources manually before using this version.

Data Sources

Cleanup

./scripts/Deploy-Lab.ps1 `
    -ResourceGroup "rg-sentinel-lab" `
    -WorkspaceName "law-sentinel-lab" `
    -Destroy

Run the same command with -WhatIf first to preview the exact deletions. Cleanup fails closed if the manifest is absent, points to another subscription/workspace, or any resource no longer carries this lab's provenance.

Evidence boundary

These queries are research starting points. They rely on naming heuristics and on tenant-specific Entra and Azure Activity schemas. Validate table availability, field names, baselines, allowlists, query cost, and false-positive behavior in a non-production workspace before enabling them. They provide suspicious-behavior evidence, not exploit attribution.

References

• CVE-2026-26118 — Microsoft vendor advisory
• CVE-2026-26118 — NIST NVD record and affected versions
• OWASP Top 10 for Agentic Applications 2026

License

MIT