LoFP / approved rollout of codex plugins such as slack, gmail, or google drive for engineering or support teams. confirm the plugin against your workspace connector inventory and change process before escalating.

Techniques

• T1176
• T1213

Sample rules

OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed

• source: elastic
• technicques:
  • T1176
  • T1213

Description

Detects the first ChatGPT Enterprise Codex plugin install for a given plugin display name and plugin name pair within the rule history window. Newly installed Codex plugins expand the tools and data sources available inside agent sessions; adversaries can enable unexpected connectors to persist access to mail, chat, or file systems after initial compromise.

Detection logic

data_stream.dataset: "openai_chatgpt_enterprise.codex_log" and
    event.action: "plugin_installed" and
    organization.id: * and
    user.email: * and
    openai_chatgpt_enterprise.codex_log.event_details.plugin_display_name: * and
    openai_chatgpt_enterprise.codex_log.event_details.plugin_name: *