Copilot - Plugin Tampering (Enable and Disable Within 5 Minutes)

Status: available
Severity: medium
Time window: 5m
Group by: ActorName, SrcIpAddr
Source: github.com/Azure/Azure-Sentinel

'Detects when a user enables and disables Copilot plugins within a 5-minute window. This behavior often indicates probing for security controls or living-off-Copilot techniques. This rule identifies discovery and defense evasion activities where users rapidly toggle plugin states, potentially testing security boundaries.'

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools
Discovery	`T1087` Account Discovery

Rule body

id: d4e5f6a7-b8c9-40d1-e2f3-a4b5c6d7e8f9
name: Copilot - Plugin Tampering (Enable and Disable Within 5 Minutes)
description: |
  'Detects when a user enables and disables Copilot plugins within a 5-minute window. This behavior often indicates probing for security controls or living-off-Copilot techniques.
  This rule identifies discovery and defense evasion activities where users rapidly toggle plugin states, potentially testing security boundaries.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftCopilot
    dataTypes:
      - CopilotActivity
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
  - DefenseEvasion
relevantTechniques:
  - T1087
  - T1562
query: |
  CopilotActivity
  | where RecordType in ("EnableCopilotPlugin","DisableCopilotPlugin")
  | summarize
      Actions = make_set(RecordType),
      FirstSeen = min(TimeGenerated),
      LastSeen = max(TimeGenerated)
    by ActorName, SrcIpAddr
  | where Actions has "EnableCopilotPlugin" and Actions has "DisableCopilotPlugin"
  | where LastSeen - FirstSeen < 5m
  | extend AccountCustomEntity = ActorName, IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CopilotActivity

Stage 2: `where`

| where RecordType in ("EnableCopilotPlugin","DisableCopilotPlugin")

Stage 3: `summarize`

| summarize
    Actions = make_set(RecordType),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
  by ActorName, SrcIpAddr

Stage 4: `where`

| where Actions has "EnableCopilotPlugin" and Actions has "DisableCopilotPlugin"

Stage 5: `where` LastSeen - FirstSeen < 5m

| where LastSeen - FirstSeen < 5m

Stage 6: `extend`

| extend AccountCustomEntity = ActorName, IPCustomEntity = SrcIpAddr

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Actions`	match	`DisableCopilotPlugin` transforms: `term` `EnableCopilotPlugin` transforms: `term`	`field:"Actions" kind:match`
`RecordType`	in	`DisableCopilotPlugin` `EnableCopilotPlugin`	`field:"RecordType" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Actions`	`summarize`
`ActorName`	`summarize`
`FirstSeen`	`summarize`
`LastSeen`	`summarize`
`SrcIpAddr`	`summarize`
`AccountCustomEntity`	`extend`
`IPCustomEntity`	`extend`

Copilot - Plugin Tampering (Enable and Disable Within 5 Minutes)

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: where

Stage 5: where LastSeen - FirstSeen < 5m

Stage 6: extend