This hunt targets adversaries exploiting weakly defined AI agent prompts to execute prompt injection attacks and manipulate system behavior through insufficient instruction constraints. Proactively hunting for these published agents in Azure Sentinel is critical to identify and remediate high-risk configurations before attackers can leverage them as entry points for data exfiltration or unauthorized command execution.
let IdentityIdtoUPN = materialize (
IdentityInfo
| where isnotempty(AccountObjectId) and isnotempty(AccountUpn)
| summarize arg_max(Timestamp, AccountUpn) by AccountObjectId
| project AccountObjectId = tostring(AccountObjectId), AccountUpn);
AgentsInfo
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus != "Deleted"
| where PublishedStatus == "Published"
| where isnotempty(Instructions) and Instructions != "N/A"
| where strlen(Instructions) < 100
| extend OwnerId = tostring(Owners[0])
| join kind=leftouter IdentityIdtoUPN on $left.OwnerId == $right.AccountObjectId
| project-rename OwnerUpn = AccountUpn
| project-away OwnerId, AccountObjectId
| project-reorder CreatedDateTime, AgentId, Name, Platform, Instructions, OwnerUpn
id: 2f1f88de-d79f-44bf-96d0-52fd9cbf49c4
name: AI Agents - Published Agents with Short Instructions
description: |
This query identifies AI agents that are published but have short or insufficient instructions (fewer than 100 characters).
Short instructions increase the risk of prompt injection attacks, where malicious input can influence the agent to deviate from its intended behavior.
Without clear guidance, the agent may respond unpredictably or expose sensitive data.
Recommended Action: Ensure all published agents have well-defined instructions that specify the agent's purpose, boundaries, and allowed actions.
Regularly review and update instructions to maintain security and prevent misuse.
requiredDataConnectors: []
tactics:
- Impact
- DefenseEvasion
relevantTechniques:
- T1499
- T1562
query: |
let IdentityIdtoUPN = materialize (
IdentityInfo
| where isnotempty(AccountObjectId) and isnotempty(AccountUpn)
| summarize arg_max(Timestamp, AccountUpn) by AccountObjectId
| project AccountObjectId = tostring(AccountObjectId), AccountUpn);
AgentsInfo
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus != "Deleted"
| where PublishedStatus == "Published"
| where isnotempty(Instructions) and Instructions != "N/A"
| where strlen(Instructions) < 100
| extend OwnerId = tostring(Owners[0])
| join kind=leftouter IdentityIdtoUPN on $left.OwnerId == $right.AccountObjectId
| project-rename OwnerUpn = AccountUpn
| project-away OwnerId, AccountObjectId
| project-reorder CreatedDateTime, AgentId, Name, Platform, Instructions, OwnerUpn
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: OwnerUpn
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Name
version: 1.0.0
| Sentinel Table | Notes |
|---|---|
IdentityInfo | Ensure this data connector is enabled |
Here are four specific false positive scenarios for the AI Agents - Published Agents with Short Instructions detection rule, along with recommended filters or exclusions:
Scheduled Maintenance & Health Check Bots
"Check status" or "Ping endpoint") because they do not process complex user input, only triggering a binary success/failure response.agent_name matches patterns like *health-check*, *heartbeat*, or *monitoring-bot*, and the instruction_content_length is less than 50 characters.Legacy Migration “Placeholder” Agents
"Legacy Wrapper v1") while awaiting full content population by subject matter experts.created_date within the last 7 days and a status tag of Draft-Migration, or specifically exclude agent IDs belonging to the IT-Infrastructure department during known migration windows.Single-Purpose Trigger Agents in RPA Workflows
Invoice-Trigger might have a 45-character instruction (`“Wait for PDF in /In