Techniques
Sample rules
OpenAI ChatGPT Enterprise User Activity From High Number of Countries
- source: elastic
- technicques:
- T1078
- T1539
Description
Detects ChatGPT Enterprise activity for the same user email from at least three countries and two unique user agents within a four-hour interval across any compliance data stream. Stolen session cookies often produce post-auth activity (conversation views, deletions, downloads) without a new login event, so this rule is not limited to authentication logs.
Detection logic
from logs-openai_chatgpt_enterprise.*
| where
user.email is not null and
source.ip is not null and
source.geo.country_iso_code is not null
| stats
Esql.country_count = count_distinct(source.geo.country_iso_code),
Esql.region_count = count_distinct(source.geo.region_name),
Esql.source_ip_count = count_distinct(source.ip),
Esql.user_agent_count = count_distinct(user_agent.original),
Esql.event_count = count(*),
Esql.event_action_values = values(event.action),
Esql.source_ip_values = values(source.ip),
Esql.source_geo_country_iso_code_values = values(source.geo.country_iso_code),
Esql.source_geo_region_name_values = values(source.geo.region_name),
Esql.source_geo_city_name_values = values(source.geo.city_name),
Esql.user_agent_original_values = values(user_agent.original),
Esql.timestamp_first_seen = min(@timestamp),
Esql.timestamp_last_seen = max(@timestamp)
by user.email
| where Esql.country_count >= 3 and Esql.user_agent_count >= 2
| keep user.email, Esql.*