Techniques
Sample rules
OpenAI ChatGPT Enterprise Suspicious Gmail Discovery
- source: elastic
- technicques:
- T1083
- T1213
Description
Detects ChatGPT Enterprise Gmail connector searches that look like sensitive discovery: attachment hunts across multiple document types, or queries matching credential, financial, HR, or legal themes. Attackers abusing a linked Gmail connector after session compromise often search mail for high-value content before exfiltration or send-as abuse.
Detection logic
from logs-openai_chatgpt_enterprise.app_log-* metadata _id, _version, _index
| where
data_stream.dataset == "openai_chatgpt_enterprise.app_log" and
openai_chatgpt_enterprise.app_log.app_name == "Gmail" and
openai_chatgpt_enterprise.app_log.app_type == "SERVICE" and
openai_chatgpt_enterprise.app_log.input is not null
| eval Esql.email_search_query = to_lower(field_extract(openai_chatgpt_enterprise.app_log.input, "query"))
| eval
Esql.attachment_search = Esql.email_search_query rlike """.*has:attachment.*""",
Esql.document_extension = Esql.email_search_query rlike """.*filename:(pdf|doc|docx|xls|xlsx|csv|ppt|pptx|txt|rtf|odt|ods|zip|7z|rar).*""",
Esql.multiple_filetypes = Esql.email_search_query rlike """.*filename:[a-z0-9]+.*filename:[a-z0-9]+.*""",
Esql.match_financial = Esql.email_search_query rlike """.*(payslip|paystub|payroll|salary|compensation|bonus|bank.account|swift|routing.number|invoice|tax.return|w2|w-2|1099).*""",
Esql.match_hr = Esql.email_search_query rlike """.*(employment.contract|offer.letter|employment.agreement|employee.records|passport|national.insurance|social.security|ssn|date.of.birth|personal.data).*""",
Esql.match_legal = Esql.email_search_query rlike """.*(confidential|restricted|internal.only|legal|settlement|merger|acquisition).*""",
Esql.match_credentials = Esql.email_search_query rlike """.*(password|passwd|credential|api.key|secret.key|private.key|access.token|client.secret|recovery.code|backup.code|ssh.key).*"""
| where
(Esql.attachment_search == true and (Esql.document_extension == true or Esql.multiple_filetypes == true)) or
Esql.match_credentials == true or
Esql.match_financial == true or
Esql.match_legal == true or
Esql.match_hr == true
| keep
_id, _version, _index, @timestamp, user.id, user.email,
Esql.email_search_query,
Esql.attachment_search,
Esql.document_extension,
Esql.multiple_filetypes,
Esql.match_financial,
Esql.match_hr,
Esql.match_legal,
Esql.match_credentials,
openai_chatgpt_enterprise.app_log.input,
data_stream.*