Detection rules › Kusto
Copilot - Plugin Created by Non-Admin User
'Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths. This rule identifies potential persistence or privilege misuse scenarios where non-administrative users create plugins that could be leveraged for malicious purposes.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Privilege Escalation |
Rule body
id: a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6
name: Copilot - Plugin Created by Non-Admin User
description: |
'Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths.
This rule identifies potential persistence or privilege misuse scenarios where non-administrative users create plugins that could be leveraged for malicious purposes.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: MicrosoftCopilot
dataTypes:
- CopilotActivity
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
- PrivilegeEscalation
relevantTechniques:
- T1546
- T1098
query: |
CopilotActivity
| where RecordType == "CreateCopilotPlugin"
| where ActorUserType != "Admin"
| extend Data = parse_json(LLMEventData)
| extend Plugin = tostring(Data.Resource[0].Property)
| project TimeGenerated, ActorName, ActorUserId, SrcIpAddr, Plugin
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: ActorName
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SrcIpAddr
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CopilotActivity
Stage 2: where
| where RecordType == "CreateCopilotPlugin"
Stage 3: where
| where ActorUserType != "Admin"
Stage 4: extend
| extend Data = parse_json(LLMEventData)
Stage 5: extend
| extend Plugin = tostring(Data.Resource[0].Property)
Stage 6: project
| project TimeGenerated, ActorName, ActorUserId, SrcIpAddr, Plugin
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ActorUserType | ne |
| field:"ActorUserType" kind:ne value:"Admin" |
RecordType | eq |
| field:"RecordType" kind:eq value:"CreateCopilotPlugin" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ActorName | project |
ActorUserId | project |
Plugin | project |
SrcIpAddr | project |
TimeGenerated | project |