Detection rules › Kusto

Copilot - Plugin Created by Non-Admin User

Status
available
Severity
high
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths. This rule identifies potential persistence or privilege misuse scenarios where non-administrative users create plugins that could be leveraged for malicious purposes.'

MITRE ATT&CK coverage

Rule body kusto

id: a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6
name: Copilot - Plugin Created by Non-Admin User
description: |
  'Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths.
  This rule identifies potential persistence or privilege misuse scenarios where non-administrative users create plugins that could be leveraged for malicious purposes.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftCopilot
    dataTypes:
      - CopilotActivity
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - PrivilegeEscalation
relevantTechniques:
  - T1546
  - T1098
query: |
  CopilotActivity
  | where RecordType == "CreateCopilotPlugin"
  | where ActorUserType != "Admin"
  | extend Data = parse_json(LLMEventData)
  | extend Plugin = tostring(Data.Resource[0].Property)
  | project TimeGenerated, ActorName, ActorUserId, SrcIpAddr, Plugin
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

CopilotActivity

Stage 2: where

| where RecordType == "CreateCopilotPlugin"

Stage 3: where

| where ActorUserType != "Admin"

Stage 4: extend

| extend Data = parse_json(LLMEventData)

Stage 5: extend

| extend Plugin = tostring(Data.Resource[0].Property)

Stage 6: project

| project TimeGenerated, ActorName, ActorUserId, SrcIpAddr, Plugin

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ActorUserTypene
  • Admin transforms: cased
RecordTypeeq
  • CreateCopilotPlugin transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
ActorNameproject
ActorUserIdproject
Pluginproject
SrcIpAddrproject
TimeGeneratedproject