AI Agents - Published Agents without Instructions

Hunt Hypothesis

This hunt targets adversaries exploiting published AI agents lacking specific instructions to execute prompt injection attacks (T1499) and manipulate agent behavior through data integrity compromises (T1562). Proactively hunting for these unconfigured agents in Azure Sentinel is critical to identify and remediate vulnerable entry points before attackers can inject malicious prompts that alter system logic or exfiltrate sensitive information.

KQL Query

let IdentityIdtoUPN = materialize (
    IdentityInfo
    | where isnotempty(AccountObjectId) and isnotempty(AccountUpn)
    | summarize arg_max(Timestamp, AccountUpn) by AccountObjectId
    | project AccountObjectId = tostring(AccountObjectId), AccountUpn);
AgentsInfo
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus != "Deleted"
| where PublishedStatus == "Published"
| where isempty(Instructions) or Instructions == "N/A"
| extend OwnerId = tostring(Owners[0])
| join kind=leftouter IdentityIdtoUPN on $left.OwnerId == $right.AccountObjectId
| project-rename OwnerUpn = AccountUpn
| project-away OwnerId, AccountObjectId
| project-reorder CreatedDateTime, AgentId, Name, Platform, Instructions, OwnerUpn

Analytic Rule Definition

id: d51077dc-2a79-45e2-a036-503d74c85111
name: AI Agents - Published Agents without Instructions
description: |
  This query identifies AI agents that are published but lack configured instructions.
  Missing instructions increase the risk of prompt injection attacks, where malicious input can influence the agent to deviate from its intended behavior.
  Without clear guidance, the agent may respond unpredictably or expose sensitive data.
  Recommended Action: Ensure all published agents have well-defined instructions that specify the agent's purpose, boundaries, and allowed actions.
  Regularly review and update instructions to maintain security and prevent misuse.
requiredDataConnectors: []
tactics:
  - Impact
  - DefenseEvasion
relevantTechniques:
  - T1499
  - T1562
query: |
  let IdentityIdtoUPN = materialize (
      IdentityInfo
      | where isnotempty(AccountObjectId) and isnotempty(AccountUpn)
      | summarize arg_max(Timestamp, AccountUpn) by AccountObjectId
      | project AccountObjectId = tostring(AccountObjectId), AccountUpn);
  AgentsInfo
  | summarize arg_max(Timestamp, *) by AgentId
  | where LifecycleStatus != "Deleted"
  | where PublishedStatus == "Published"
  | where isempty(Instructions) or Instructions == "N/A"
  | extend OwnerId = tostring(Owners[0])
  | join kind=leftouter IdentityIdtoUPN on $left.OwnerId == $right.AccountObjectId
  | project-rename OwnerUpn = AccountUpn
  | project-away OwnerId, AccountObjectId
  | project-reorder CreatedDateTime, AgentId, Name, Platform, Instructions, OwnerUpn
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: OwnerUpn
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Name
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: Impact
• Tactic: DefenseEvasion
• Technique: T1499 — T1499
• Technique: T1562 — T1562

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/AI Agents/AgentsInfoNoInstructions.yaml)

False Positive Guidance

Here are 4 specific false positive scenarios for the AI Agents - Published Agents without Instructions rule, including suggested filters and exclusions:

• Automated Data Pipeline Orchestration Agents

  • Scenario: In environments using tools like Microsoft Azure Logic Apps or UiPath, scheduled ETL (Extract, Transform, Load) jobs often spin up temporary AI agents to process batch data. These agents are published in “production” state but rely entirely on the underlying SQL schema or API payload structure for logic rather than natural language instructions. They are triggered by a nightly cron job and do not interact with end-users via chat interfaces.
  • Filter/Exclusion: Exclude agents where the agent_type equals "batch_processor" AND the last_user_interaction_timestamp is null (or older than 30 days). Additionally, filter out agents whose deployment_environment tag includes “ETL” or “DataOps”.

• Legacy System Migration Staging Agents

  • Scenario: During a migration project using AWS Bedrock or Google Vertex AI, administrators often publish “skeleton” agents to test connectivity and latency before the final prompt engineering phase is complete. These agents are marked as published to allow integration testing but intentionally lack formal instructions until the business logic team finalizes the system prompts. They exist primarily for API handshake validation by DevOps engineers.
  • Filter/Exclusion: Create an exclusion list based on naming conventions, specifically filtering out agent names containing prefixes like _STAGING_, MIGRATION_PHASE1, or TEST_CONN. Alternatively, exclude agents where the created_by user belongs to the “DevOps” or “Migration_Team” groups and the status is published for less than 7 days.

• Developer Sandbox and CI/CD Pipeline Agents

  • Scenario: In a