LoFP LoFP / developers create codex tokens for ci runners and local environments.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Codex Access Token Created

Description

Detects ChatGPT Enterprise Codex events that create an access token. Codex access tokens enable automated CLI or environment access and can be abused for persistence or lateral automation after account compromise. Treat tokens with a missing expires_at as higher priority during triage.

Detection logic

from logs-openai_chatgpt_enterprise.codex_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.codex_log" and
    event.action == "access_token_created"
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email,
    openai_chatgpt_enterprise.codex_log.client_id,
    openai_chatgpt_enterprise.codex_log.event_details.access_token_id,
    openai_chatgpt_enterprise.codex_log.event_details.access_token_name,
    openai_chatgpt_enterprise.codex_log.event_details.created_by_user_id,
    openai_chatgpt_enterprise.codex_log.event_details.expires_at,
    data_stream.*