LoFP LoFP / it administrators legitimately promote users to account-owner during staffing changes.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Account Owner Role Assigned

Description

Detects ChatGPT Enterprise audit events where a user role is updated to account-owner. Account owners control workspace membership, connectors, usage limits, and other security-sensitive settings. An adversary who promotes a compromised account to owner gains durable control-plane access.

Detection logic

from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "user_role_updated" and
    (
        openai_chatgpt_enterprise.audit_log.action_data.new_role == "account-owner" or
        openai_chatgpt_enterprise.audit_log.action_data.role == "account-owner"
    )
| keep
    _id, _version, _index, @timestamp, event.action, event.outcome, user.id, user.email, source.ip,
    source.geo.country_iso_code, openai_chatgpt_enterprise.audit_log.action_data.role,
    openai_chatgpt_enterprise.audit_log.action_data.new_role,
    openai_chatgpt_enterprise.audit_log.action_data.previous_role,
    openai_chatgpt_enterprise.audit_log.action_data.user_id,
    openai_chatgpt_enterprise.audit_log.action_privilege,
    openai_chatgpt_enterprise.audit_log.actor.type, data_stream.*