Copilot - File Uploads Disabled

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Detects when file uploads are disabled in Copilot. Attackers often disable logging or file upload capabilities to avoid evidence collection and cover their tracks. This rule identifies potential data exfiltration cover-up scenarios where security controls are being disabled.'

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Rule body

id: c3d4e5f6-a7b8-49c0-d1e2-f3a4b5c6d7e8
name: Copilot - File Uploads Disabled
description: |
  'Detects when file uploads are disabled in Copilot. Attackers often disable logging or file upload capabilities to avoid evidence collection and cover their tracks.
  This rule identifies potential data exfiltration cover-up scenarios where security controls are being disabled.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftCopilot
    dataTypes:
      - CopilotActivity
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562.001
query: |
  CopilotActivity
  | where RecordType == "DisableCopilotPlugin"
  | extend Resource = parse_json(LLMEventData).Resource[0]
  | extend Property = tostring(Resource.Property)
  | extend Old = tostring(Resource.OriginalValue)
  | extend New = tostring(Resource.NewValue)
  | where Property == "FileUploads" and Old == "Enabled" and New == "Disabled"
  | project TimeGenerated, ActorName, SrcIpAddr, Property, Old, New
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CopilotActivity

Stage 2: `where`

| where RecordType == "DisableCopilotPlugin"

Stage 3: `extend` (4 consecutive steps)

| extend Resource = parse_json(LLMEventData).Resource[0]
| extend Property = tostring(Resource.Property)
| extend Old = tostring(Resource.OriginalValue)
| extend New = tostring(Resource.NewValue)

Stage 4: `where`

| where Property == "FileUploads" and Old == "Enabled" and New == "Disabled"

Stage 5: `project`

| project TimeGenerated, ActorName, SrcIpAddr, Property, Old, New

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`New`	eq	`Disabled`	`field:"New" kind:eq value:"Disabled"`
`Old`	eq	`Enabled`	`field:"Old" kind:eq value:"Enabled"`
`Property`	eq	`FileUploads`	`field:"Property" kind:eq value:"FileUploads"`
`RecordType`	eq	`DisableCopilotPlugin`	`field:"RecordType" kind:eq value:"DisableCopilotPlugin"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActorName`	`project`
`New`	`project`
`Old`	`project`
`Property`	`project`
`SrcIpAddr`	`project`
`TimeGenerated`	`project`

Copilot - File Uploads Disabled

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend (4 consecutive steps)

Stage 4: where