Copilot Agent: The Good, the Bad, and the Ugly

It's been a while since my last LinkedIn article in August, but after attending some of the online sessions from Microsoft Ignite, I felt inspired to write this article about Copilot Agents. This product was one of the central features showcased by Microsoft, and I've had extensive experience using it over the past nine months as both an end user and a system and cybersecurity admin for my organization.

The Good: Copilot Agents are revolutionizing the way we work, offering unparalleled assistance and efficiency. These AI companions streamline workflows, handle mundane tasks, and provide valuable insights, freeing up our time for more strategic endeavors. They learn and adapt to our preferences, making interactions smoother and more personalized.

For example, I bought the book "The Definitive Guide to KQL" from Microsoft Press and built a Copilot Agent for it. This agent references KQL programming information and helps me generate optimized KQL statements for my threat hunting and detection queries.

The Bad: In the realm of cybersecurity, Copilot Agents introduce significant compliance and control challenges. Microsoft designed these agents so that Tenant Admins have no control over who can create them. This lack of oversight can lead to security gaps, as unauthorized individuals might create Copilot Agents without proper security protocols, potentially exposing sensitive information and increasing the risk of cyber-attacks. All relevant information can be found in Message Center MC908119.

To address this shortfall, I’ve developed a custom KQL detection in DefenderXDR. This detection identifies any newly installed, non-whitelisted Copilot extensions and alerts the M365 Admin for review. The M365 Admin can then block these extensions in the Integrated Apps section of the admin portal, reclaiming some control.

https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/main/DefenderXDR/Detecting%20New%20Copilot%20Extensions.kql

// Added your whitelisted extensions or plugins to WLExtensions
let WLExtensions = dynamic(["BingWebSearch"]);
CloudAppEvents
| where Timestamp > ago(1h)
| where ActionType == @"CopilotInteraction"
| extend UserID = tostring(RawEventData.UserId)
| extend CopilotData = todynamic(RawEventData.CopilotEventData)
| extend CopilotPlugin = tostring(CopilotData.AISystemPlugin[0].Id)
| where isnotempty(CopilotPlugin)
| where not (CopilotPlugin has_any (WLExtensions))
| project Timestamp, AccountObjectId, UserID, CopilotPlugin, ReportId        

The Ugly: Consider a scenario where a user account is compromised, and a threat actor uses this account to create a Copilot Agent on a highly sensitive SharePoint site that the compromised user has access to. The threat actor could then exfiltrate data by accessing the private link created by the Copilot Agent, slowly extracting information as needed by providing the relevant prompts. This scenario highlights the significant risks associated with insufficient access controls and the potential for misuse of Copilot Agents in critical environments.

To address such threats, I have additionally deployed Sentinel Solution for Microsoft Power Platform and I have created a KQL detection using Sentinel Behavior Analytics and Power Platform solutions to monitor any potential malicious Copilot Agent creation.

https://learn.microsoft.com/en-us/azure/sentinel/business-applications/power-platform-solution-overview?WT.mc_id=Portal-Microsoft_Azure_Marketplace

https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/main/Sentinel/Hunting%20Malicious%20Copilot%20Agent.kql

let HighRiskUsers =
BehaviorAnalytics
| where InvestigationPriority > 0
| where UsersInsights.BlastRadius == "High"
| where ActivityType == "LogOn"
| where ActionType == "ResourceAccess"
| distinct UserPrincipalName;
PowerPlatformAdminActivity
| where EventOriginalType in ("BotCreate", "BotComponentCreate", "BotUpdateOperation-BotPublish")
| where ActorName has_any(HighRiskUsers)        

Conclusion: Copilot Agents offer a powerful tool for enhancing productivity and efficiency, but they also bring new challenges and risks, especially in the realm of cybersecurity. By recognizing both the benefits and the potential pitfalls, we can better leverage these tools while ensuring robust security measures are in place. My experiences over the past nine months have shown me both the incredible potential and the critical vulnerabilities of Copilot Agents, and I hope this article provides valuable insights for those considering their implementation.

Updated 26/11/2024:

Additional controls introduced by Microsoft

Restricted Content Discoverability (RCD) for SharePoint Sites

Do support this LinkedIn article if you find the information are useful and repost for sharing with the wider Microsoft cyber defender community. ?????????? ?????? ???????? ?????????? ???? ???? ???????????????? ?????????????? to receive all futures post ??????????????. Thanks! ??