Copilot - Plugin Created by Non-Admin User

Back


Id	a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6
Rulename	Copilot - Plugin Created by Non-Admin User
Description	Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths. This rule identifies potential persistence or privilege misuse scenarios where non-administrative users create plugins that could be leveraged for malicious purposes.
Severity	High
Tactics	Persistence PrivilegeEscalation
Techniques	T1546 T1098
Required data connectors	MicrosoftCopilot
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Copilot/Analytic Rules/CopilotPluginCreatedByNonAdmin.yaml
Version	1.0.0
Arm template	a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6.json

KQL

CopilotActivity
| where RecordType == "CreateCopilotPlugin"
| where ActorUserType != "Admin"
| extend Data = parse_json(LLMEventData)
| extend Plugin = tostring(Data.Resource[0].Property)
| project TimeGenerated, ActorName, ActorUserId, SrcIpAddr, Plugin

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Copilot/Analytic Rules/CopilotPluginCreatedByNonAdmin.yaml
queryPeriod: 1h
description: |
  'Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths.
  This rule identifies potential persistence or privilege misuse scenarios where non-administrative users create plugins that could be leveraged for malicious purposes.'  
triggerThreshold: 0
name: Copilot - Plugin Created by Non-Admin User
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
kind: Scheduled
requiredDataConnectors:
- connectorId: MicrosoftCopilot
  dataTypes:
  - CopilotActivity
queryFrequency: 1h
tactics:
- Persistence
- PrivilegeEscalation
id: a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6
status: Available
version: 1.0.0
query: |
  CopilotActivity
  | where RecordType == "CreateCopilotPlugin"
  | where ActorUserType != "Admin"
  | extend Data = parse_json(LLMEventData)
  | extend Plugin = tostring(Data.Resource[0].Property)
  | project TimeGenerated, ActorName, ActorUserId, SrcIpAddr, Plugin  
severity: High
relevantTechniques:
- T1546
- T1098

ARM