Lab: MCP Attack-Chain Detection with Sentinel

Detect MCP server attack chains spanning SSRF token theft, tool poisoning, cross-server exfiltration, and identity post-exploitation.

Overview

This repository-first lab provides Sentinel detections and hunts for multi-stage Model Context Protocol attack chains, with mappings to the OWASP Agentic Top 10 and defensive investigation guidance.

For broader platform hardening context, read Sentinel MCP Server: Securing Your SOC’s New AI Attack Surface. This related background is separate from the detection repository’s deployment guide.

Review Status

Source reviewed July 10, 2026. All analytics-rule/workbook JSON and PowerShell 7.3+ syntax were checked, flat and wrapped Azure CLI response shapes were simulated, saved-search aliases and deterministic deployment IDs were reviewed, and the documentation was reconciled with the repository. The KQL was not executed against a live tenant, so table schemas, ingestion, thresholds, and permissions still need validation in your Sentinel workspace.

Safety and Limits

  • Deploy to a lab workspace first. The analytics rules are enabled and can create incidents when their heuristics match.
  • The hunts infer suspicious MCP-associated behavior from identity names, activity, and sign-in tables. A match is investigation evidence, not proof of SSRF, tool poisoning, privilege abuse, or effective RBAC. Conditional Access status also does not prove TLS/mTLS state or non-TLS traffic.
  • The deploy script requires PowerShell 7.3+, prints the subscription, resource group, and workspace, and treats deployment or destruction as a high-impact operation. Use -WhatIf to preview the single scoped operation or -Confirm:$false only for an intentional noninteractive run.
  • Repeat deployments write each deterministic rule and workbook first, then remove only exact-display-name legacy rule duplicates and legacy mcp-security-posture-* workbooks. That first upgraded run is the migration path, so a failed replacement does not remove the prior detection first.
  • -Destroy removes only the lab’s deterministic/exact analytics rules, exact saved-search names in the lab category, deterministic workbook, and legacy workbook prefix. It leaves the workspace, source data, connectors, unrelated content, and already-created incidents intact.
  • Query execution, ingestion, retention, and incident generation can incur charges under the existing Sentinel and Log Analytics plans.

Start Here

  1. Open the canonical GitHub repository.
  2. Confirm the required Sentinel tables and permissions before importing content.
  3. Follow the README through analytics-rule deployment, tenant-specific KQL validation, workbook review, and cleanup.

Tune the keywords and baselines to your environment. Do not target MCP servers or identities you do not own or administer.