Copilot - Plugin Created by Non-Admin User | Microsoft Sentinel Analytic Rules

Back


Id	a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6
Rulename	Copilot - Plugin Created by Non-Admin User
Description	Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths. This rule identifies potential persistence or privilege misuse scenarios where non-administrative users create plugins that could be leveraged for malicious purposes.
Severity	High
Tactics	Persistence PrivilegeEscalation
Techniques	T1546 T1098
Required data connectors	MicrosoftCopilot
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Copilot/Analytic%20Rules/CopilotPluginCreatedByNonAdmin.yaml
Version	1.0.0
Arm template	a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6.json

KQL

CopilotActivity
| where RecordType == "CreateCopilotPlugin"
| where ActorUserType != "Admin"
| extend Data = parse_json(LLMEventData)
| extend Plugin = tostring(Data.Resource[0].Property)
| project TimeGenerated, ActorName, ActorUserId, SrcIpAddr, Plugin

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ActorName
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
query: |
  CopilotActivity
  | where RecordType == "CreateCopilotPlugin"
  | where ActorUserType != "Admin"
  | extend Data = parse_json(LLMEventData)
  | extend Plugin = tostring(Data.Resource[0].Property)
  | project TimeGenerated, ActorName, ActorUserId, SrcIpAddr, Plugin
id: a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6
queryFrequency: 1h
status: Available
version: 1.0.0
severity: High
relevantTechniques:
- T1546
- T1098
name: Copilot - Plugin Created by Non-Admin User
kind: Scheduled
tactics:
- Persistence
- PrivilegeEscalation
requiredDataConnectors:
- dataTypes:
  - CopilotActivity
  connectorId: MicrosoftCopilot
description: |
  'Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths.
  This rule identifies potential persistence or privilege misuse scenarios where non-administrative users create plugins that could be leveraged for malicious purposes.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Copilot/Analytic%20Rules/CopilotPluginCreatedByNonAdmin.yaml
triggerOperator: gt
triggerThreshold: 0
queryPeriod: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6')]",
      "properties": {
        "alertRuleTemplateName": "a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6",
        "customDetails": null,
        "description": "'Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths.\nThis rule identifies potential persistence or privilege misuse scenarios where non-administrative users create plugins that could be leveraged for malicious purposes.'\n",
        "displayName": "Copilot - Plugin Created by Non-Admin User",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Copilot/Analytic%20Rules/CopilotPluginCreatedByNonAdmin.yaml",
        "query": "CopilotActivity\n| where RecordType == \"CreateCopilotPlugin\"\n| where ActorUserType != \"Admin\"\n| extend Data = parse_json(LLMEventData)\n| extend Plugin = tostring(Data.Resource[0].Property)\n| project TimeGenerated, ActorName, ActorUserId, SrcIpAddr, Plugin\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1098",
          "T1546"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}