# Coordinated Tool Abuse Across Sessions

- **Severity:** Medium
- **Signature ID:** `a4422f2a-9c88-5eca-9eaf-8f7ed6978ebf`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation)

## Summary

This detects a sensitive tool (things like secrets access, permission changes, or similar) being called over and over across separate sessions and days. Each individual call looks fine on its own — it's authorized and unremarkable. The pattern only shows up when you look at volume over a longer window, which is what suggests a coordinated campaign rather than a one-off request.

## How the attack works

An agent or set of agents makes repeated calls to a tool flagged as sensitive. No single call stands out as suspicious — access is authorized each time. The rule keeps a persistent count of these calls in hourly buckets going back 24 hours, so it can spot volume that builds up across many separate sessions rather than within one short session or conversation. When the accumulated count crosses a threshold, it flags the tool as being driven unusually hard.

## Why it matters

An organization could miss a slow, distributed abuse of a sensitive capability — such as an agent (or someone directing multiple agents) systematically pulling secrets or changing permissions one authorized-looking call at a time — because no individual action triggers scrutiny.

## What you can do

- Maintain and review a list of tools your organization considers sensitive (secrets access, permission or credential changes, bulk data export) so this kind of tracking has something meaningful to watch.
- When this fires, check whether the volume matches a known deliberate bulk operation (like a planned secret rotation) or scheduled automation/CI before treating it as suspicious.
- If legitimate CI or scheduled jobs call a sensitive tool routinely, document that pattern so reviewers can quickly distinguish it from anomalous activity.
- Review tool-name matching rules periodically — a tool with a name that merely resembles a sensitive keyword can cause false positives, so refine naming criteria as needed.

## Known benign look-alikes

- Bulk operations an operator deliberately asked for (rotating every secret, migrating a permission model) — expect one report per tool per 24h
- CI or scheduled automation that legitimately calls a secrets tool per job
- A tool whose name merely contains a marker word ("keyword_search", "tokenizer") — tighten SENSITIVE_TOOL_MARKERS if that produces noise

## References

- https://attack.mitre.org/techniques/T1078/
- https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438

---
Source: https://www.netzilo.com/threats/coordinated-tool-abuse