Add three MCP detections to the Suspicious MCP Activities story

detections/application/mcp_source_code_secret_search.yml

@@ -0,0 +1,60 @@
+name: MCP Source Code Secret Search
+id: a73b6353-4b34-4a20-8442-76bbb6374616
+version: 1
+creation_date: '2026-06-15'
+modification_date: '2026-06-15'
+author: Adam Lin
+status: production
+type: TTP
+description: This detection identifies code-search operations through MCP (Model Context Protocol) tool calls that target credential and secret patterns. An adversary who controls an MCP-enabled agent can abuse repository search tools to harvest hard-coded secrets - querying for terms such as password, api_key, secret, token, or provider-specific key prefixes (sk_live, ghp_, AKIA). The search monitors inbound JSON-RPC search_code traffic for these high-signal query terms and surfaces the query and owner so analysts can confirm whether the activity is credential harvesting.
+data_source:
+    - MCP Server
+search: |
+    `mcp_server` direction=inbound method=search_code ( "password" OR "api_key" OR "secret" OR "token" OR "credential" OR "private_key" OR "sk_live" OR "ghp_" OR "AKIA" )
+    | eval dest=host
+    | eval search_query='params.query'
+    | eval target_owner='params.owner'
+    | stats count min(_time) as firstTime max(_time) as lastTime values(method) as method values(search_query) as search_query values(target_owner) as target_owner by dest, source
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | table dest firstTime lastTime count source method search_query target_owner
+    | `mcp_source_code_secret_search_filter`
+how_to_implement: This detection requires the MCP Technology Add-on (TA) for Splunk configured to ingest JSON-RPC formatted logs from MCP-enabled AI assistants and agents into the appropriate index with sourcetype mcp:jsonrpc. Ensure the TA parses the params.query and params.owner fields so the code-search term and target organization are available. The macro mcp_source_code_secret_search_filter should be created to allow environment-specific tuning and to allowlist legitimate security-scanning workflows.
+known_false_positives: Security teams, secret-scanning tools, and developers legitimately search code for these terms during code review or remediation. Tune the mcp_source_code_secret_search_filter macro to allowlist approved scanning identities and focus on searches originating from unexpected agents or accounts.
+references:
+    - https://github.com/Agent-Threat-Rule/agent-threat-rules
+    - https://agentthreatrule.org
+    - https://www.splunk.com/en_us/blog/security/securing-ai-agents-model-context-protocol.html
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search dest="$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$dest$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: 'A credential-pattern code search ($search_query$) was performed on $dest$ via an MCP server tool call against organization $target_owner$. Searching source code for secrets through an agent may indicate credential harvesting.'
+    entity:
+        field: dest
+        type: system
+        score: 60
+analytic_story:
+    - Suspicious MCP Activities
+asset_type: Web Application
+mitre_attack_id:
+    - T1552.001
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/mcp/mcp.log
+          sourcetype: mcp:jsonrpc
+          source: mcp.log
+      test_type: unit

detections/application/mcp_suspicious_file_deletion.yml

@@ -0,0 +1,60 @@
+name: MCP Suspicious File Deletion
+id: 5a2b38a5-b21d-4d8e-a6a8-7adfb47f0557
+version: 1
+creation_date: '2026-06-15'
+modification_date: '2026-06-15'
+author: Adam Lin
+status: production
+type: TTP
+description: This detection identifies file deletion operations performed through MCP (Model Context Protocol) tool calls. An adversary who has compromised or hijacked an MCP-enabled agent can use its file system or repository tools to destroy data or remove security-relevant files such as SECURITY.md, audit logs, or CI configuration, achieving data destruction and defense evasion. The search monitors inbound JSON-RPC traffic for delete_file operations and aggregates the deleted paths per host so analysts can spot anomalous volume or the removal of sensitive files.
+data_source:
+    - MCP Server
+search: |
+    `mcp_server` direction=inbound method=delete_file
+    | eval dest=host
+    | eval target_path='params.path'
+    | eval target_repo='params.repo'
+    | stats count min(_time) as firstTime max(_time) as lastTime values(method) as method values(target_path) as target_path values(target_repo) as target_repo by dest, source
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | table dest firstTime lastTime count source method target_path target_repo
+    | `mcp_suspicious_file_deletion_filter`
+how_to_implement: This detection requires the MCP Technology Add-on (TA) for Splunk configured to ingest JSON-RPC formatted logs from MCP-enabled AI assistants and agents into the appropriate index with sourcetype mcp:jsonrpc. Ensure the TA parses the params.path and params.repo fields so the deleted file path and target repository are available. The macro mcp_suspicious_file_deletion_filter should be created to allow environment-specific tuning, for example raising the count threshold or allowlisting paths that are routinely cleaned up by automation.
+known_false_positives: Legitimate cleanup, refactoring, and automated housekeeping delete files through agent tooling. Tune the mcp_suspicious_file_deletion_filter macro to allowlist expected automation and focus on the deletion of security-relevant files or unusually high deletion volume from a single host.
+references:
+    - https://github.com/Agent-Threat-Rule/agent-threat-rules
+    - https://agentthreatrule.org
+    - https://www.splunk.com/en_us/blog/security/securing-ai-agents-model-context-protocol.html
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search dest="$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$dest$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: 'A file deletion ($target_path$) was performed on $dest$ via an MCP server tool call against repository $target_repo$. Deletion of security-relevant files or high deletion volume through an agent may indicate data destruction or defense evasion.'
+    entity:
+        field: dest
+        type: system
+        score: 65
+analytic_story:
+    - Suspicious MCP Activities
+asset_type: Web Application
+mitre_attack_id:
+    - T1485
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/mcp/mcp.log
+          sourcetype: mcp:jsonrpc
+          source: mcp.log
+      test_type: unit

detections/application/mcp_webhook_persistence_creation.yml

@@ -0,0 +1,61 @@
+name: MCP Webhook Persistence Creation
+id: db95f667-0193-4854-86d6-60cd39d0b3ac
+version: 1
+creation_date: '2026-06-15'
+modification_date: '2026-06-15'
+author: Adam Lin
+status: production
+type: TTP
+description: This detection identifies the creation of repository webhooks through MCP (Model Context Protocol) tool calls. Adversaries who gain access to an MCP-enabled agent can register a webhook that points to an attacker-controlled endpoint, giving them durable persistence and a covert exfiltration channel - every future repository event (pushes, pull requests, secrets) is delivered to the external URL without any further interaction. The search monitors inbound JSON-RPC traffic for create_webhook operations and surfaces the destination URL, repository, and owner so analysts can confirm whether the endpoint is legitimate.
+data_source:
+    - MCP Server
+search: |
+    `mcp_server` direction=inbound method=create_webhook
+    | eval dest=host
+    | eval webhook_url='params.url'
+    | eval target_repo='params.repo'
+    | eval target_owner='params.owner'
+    | stats count min(_time) as firstTime max(_time) as lastTime values(method) as method values(webhook_url) as webhook_url values(target_repo) as target_repo values(target_owner) as target_owner by dest, source
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | table dest firstTime lastTime count source method webhook_url target_repo target_owner
+    | `mcp_webhook_persistence_creation_filter`
+how_to_implement: This detection requires the MCP Technology Add-on (TA) for Splunk configured to ingest JSON-RPC formatted logs from MCP-enabled AI assistants and agents into the appropriate index with sourcetype mcp:jsonrpc. Ensure the TA parses the params.url, params.repo, and params.owner fields so the webhook destination and target repository are available. The macro mcp_webhook_persistence_creation_filter should be created to allow environment-specific tuning, for example whitelisting webhook URLs that belong to approved CI/CD or monitoring integrations.
+known_false_positives: Legitimate automation, CI/CD onboarding, and developer tooling routinely create repository webhooks. Tune the mcp_webhook_persistence_creation_filter macro to allowlist known-good destination domains (for example your CI provider) and focus on webhooks pointing to unfamiliar or external endpoints.
+references:
+    - https://github.com/Agent-Threat-Rule/agent-threat-rules
+    - https://agentthreatrule.org
+    - https://www.splunk.com/en_us/blog/security/securing-ai-agents-model-context-protocol.html
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search dest="$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$dest$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: 'A repository webhook pointing to $webhook_url$ was created on $dest$ via an MCP server tool call against repository $target_repo$. Attacker-controlled webhooks provide persistence and an exfiltration channel by delivering repository events to an external endpoint.'
+    entity:
+        field: dest
+        type: system
+        score: 60
+analytic_story:
+    - Suspicious MCP Activities
+asset_type: Web Application
+mitre_attack_id:
+    - T1546
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/mcp/mcp.log
+          sourcetype: mcp:jsonrpc
+          source: mcp.log
+      test_type: unit