Techniques
Sample rules
Potential Azure OpenAI Model Theft
- source: elastic
- technicques:
Description
Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are unusual during model interactions.
Detection logic
from logs-azure_openai.logs-*
| where
azure.open_ai.operation_name == "ListKey" and
azure.open_ai.category == "Audit"
| keep
@timestamp,
azure.open_ai.operation_name,
azure.open_ai.category,
azure.resource.group,
azure.resource.name,
azure.open_ai.properties.response_length
| stats
Esql.event_count = count(*),
Esql.azure_open_ai_properties_response_length_max = max(azure.open_ai.properties.response_length)
by
azure.resource.group,
azure.resource.name
| where
Esql.event_count >= 100 or
Esql.azure_open_ai_properties_response_length_max >= 1000000
| sort
Esql.event_count desc