OpenAI Admin Role Assignment

Severity: high
Log types: OpenAI.Audit
Reference: https://platform.openai.com/docs/api-reference/audit-logs
Source: github.com/panther-labs/panther-analysis

Detects when an admin or owner role is assigned to a user or group in OpenAI. Admin and owner roles grant elevated privileges that allow significant control over the organization, including managing users, API keys, billing, and security settings. Unauthorized or unexpected admin role assignments can indicate: - Privilege escalation attempts - Insider threats - Compromised administrator accounts - Policy violations This rule alerts on all admin role assignments for visibility and audit purposes.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1078` Valid Accounts, `T1098.003` Account Manipulation: Additional Cloud Roles
Privilege Escalation	`T1078` Valid Accounts, `T1098.003` Account Manipulation: Additional Cloud Roles
Stealth	`T1078` Valid Accounts

Rule body yaml

AnalysisType: rule
Description: |
  Detects when an admin or owner role is assigned to a user or group in OpenAI.
  Admin and owner roles grant elevated privileges that allow significant control over
  the organization, including managing users, API keys, billing, and security settings.
  Unauthorized or unexpected admin role assignments can indicate:
  - Privilege escalation attempts
  - Insider threats
  - Compromised administrator accounts
  - Policy violations
  This rule alerts on all admin role assignments for visibility and audit purposes.
DisplayName: "OpenAI Admin Role Assignment"
Enabled: true
Filename: openai_admin_role_assignment.py
Reference: https://platform.openai.com/docs/api-reference/audit-logs
Runbook: |
  1. Verify the role assignment was authorized. Confirm the assigned user/group should have admin privileges and the assignment aligns with approved access requests or organizational policy.
  2. Review the assignment context including the actor performing the assignment, source IP address, geolocation, and timing. Check for anomalous patterns such as assignments from unusual locations or during off-hours.
  3. If the assignment is suspicious or unauthorized, immediately revoke the admin role. Review all actions performed by the principal since the role was granted, investigate potential account compromise of the actor who granted the role, and escalate for security review.
Reports:
  MITRE ATT&CK:
    - TA0003:T1098  # Account Manipulation
    - TA0004:T1078  # Valid Accounts
    - TA0005:T1098.003  # Additional Cloud Roles
Severity: High
DedupPeriodMinutes: 60
Threshold: 1
LogTypes:
  - OpenAI.Audit
RuleID: "OpenAI.Admin.Role.Assignment"
Tests:
  - Name: "Admin role assignment - organization owner - Alert"
    ExpectedResult: true
    Log:
      id: "audit_log-test001"
      type: "role.assignment.created"
      effective_at: 1702857600
      object: "organization.audit_log"
      actor:
        type: "session"
        session:
          user:
            id: "user-admin123"
            email: "admin@company.com"
          ip_address: "203.0.113.100"
          user_agent: "Mozilla/5.0"
          ip_address_details:
            country: "US"
            city: "San Francisco"
            region: "California"
      role_assignment_created:
        id: "role_assignment_role-api-organization-owner__api-organization__org-abc123_user-newadmin456"
        principal_id: "user-newadmin456"
        principal_type: "user"
        resource_id: "org-abc123"
        resource_type: "api.organization"
  - Name: "Admin role assignment - contains admin keyword - Alert"
    ExpectedResult: true
    Log:
      id: "audit_log-test002"
      type: "role.assignment.created"
      effective_at: 1702857600
      object: "organization.audit_log"
      actor:
        type: "session"
        session:
          user:
            id: "user-superadmin001"
            email: "superadmin@company.com"
          ip_address: "192.0.2.50"
          user_agent: "Mozilla/5.0"
      role_assignment_created:
        id: "role_assignment_role-api-project-admin__api-project__proj-xyz789_user-contractor999"
        principal_id: "user-contractor999"
        principal_type: "user"
        resource_id: "proj-xyz789"
        resource_type: "api.project"
  - Name: "Group assigned owner role - Alert"
    ExpectedResult: true
    Log:
      id: "audit_log-test003"
      type: "role.assignment.created"
      effective_at: 1702857600
      object: "organization.audit_log"
      actor:
        type: "session"
        session:
          user:
            id: "user-admin123"
            email: "admin@company.com"
          ip_address: "203.0.113.100"
          user_agent: "Mozilla/5.0"
      role_assignment_created:
        id: "role_assignment_role-api-organization-owner__api-organization__org-abc123_group-engineering001"
        principal_id: "group-engineering001"
        principal_type: "group"
        resource_id: "org-abc123"
        resource_type: "api.organization"
  - Name: "Non-admin role assignment - reader - No Alert"
    ExpectedResult: false
    Log:
      id: "audit_log-test004"
      type: "role.assignment.created"
      effective_at: 1702857600
      object: "organization.audit_log"
      actor:
        type: "session"
        session:
          user:
            id: "user-admin123"
            email: "admin@company.com"
          ip_address: "203.0.113.100"
          user_agent: "Mozilla/5.0"
      role_assignment_created:
        id: "role_assignment_role-api-organization-reader__api-organization__org-abc123_user-employee456"
        principal_id: "user-employee456"
        principal_type: "user"
        resource_id: "org-abc123"
        resource_type: "api.organization"
  - Name: "Non-admin role assignment - viewer - No Alert"
    ExpectedResult: false
    Log:
      id: "audit_log-test005"
      type: "role.assignment.created"
      effective_at: 1702857600
      object: "organization.audit_log"
      actor:
        type: "session"
        session:
          user:
            id: "user-manager001"
            email: "manager@company.com"
          ip_address: "198.51.100.25"
          user_agent: "Mozilla/5.0"
      role_assignment_created:
        id: "role_assignment_role-api-project-viewer__api-project__proj-def456_user-intern789"
        principal_id: "user-intern789"
        principal_type: "user"
        resource_id: "proj-def456"
        resource_type: "api.project"
  - Name: "Role assignment removed - No Alert"
    ExpectedResult: false
    Log:
      id: "audit_log-test006"
      type: "role.assignment.deleted"
      effective_at: 1702857600
      object: "organization.audit_log"
      actor:
        type: "session"
        session:
          user:
            id: "user-admin123"
            email: "admin@company.com"
          ip_address: "203.0.113.100"
          user_agent: "Mozilla/5.0"
      role_assignment_deleted:
        id: "role_assignment_role-api-organization-owner__api-organization__org-abc123_user-oldadmin999"
        principal_id: "user-oldadmin999"
        principal_type: "user"
  - Name: "Unrelated event type - No Alert"
    ExpectedResult: false
    Log:
      id: "audit_log-test007"
      type: "login.succeeded"
      effective_at: 1702857600
      object: "organization.audit_log"
      actor:
        type: "session"
        session:
          user:
            id: "user-normal001"
            email: "user@company.com"
          ip_address: "203.0.113.200"
          user_agent: "Mozilla/5.0"

Detection logic

Condition

type eq "role.assignment.created"
role_assignment_created.id is_not_null

This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`role_assignment_created.id`	is_not_null	(no value, null check)
`type`	eq	`role.assignment.created`

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field	Source
`event_type`	`type`
`event_id`	`id`
`assignment_id`	`role_assignment_created.id`
`principal_id`	`role_assignment_created.principal_id`
`principal_type`	`role_assignment_created.principal_type`
`resource_id`	`role_assignment_created.resource_id`
`resource_type`	`role_assignment_created.resource_type`
`actor_email`	`actor.session.user.email`
`actor_id`	`actor.session.user.id`
`source_ip`	`actor.session.ip_address`
`user_agent`	`actor.session.user_agent`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)