Elastic Security Detection Rules

OpenAI ChatGPT Enterprise Account Owner Role Assigned

Last updated 11 days ago on 2026-10-06
Created 11 days ago on 2026-10-06

About

Detects ChatGPT Enterprise audit events where a user role is updated to account-owner. Account owners control workspace membership, connectors, usage limits, and other security-sensitive settings. An adversary who promotes a compromised account to owner gains durable control-plane access.
Tags
Domain: GenAIPlatform: OpenAIData Source: OpenAI ChatGPT EnterpriseService: OpenAI ChatGPT EnterpriseUse Case: Threat DetectionRule Type: ES|QLDomain: IdentityUse Case: Identity and Access AuditTactic: PersistenceTactic: Privilege EscalationMitre Atlas: AML.T0012Language: esql
Severity
high
Risk Score
73
MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

Privilege Escalation (TA0004)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

False Positive Examples
IT administrators legitimately promote users to account-owner during staffing changes.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

openai_chatgpt_enterprise(external, opens in a new tab or window)

Query
text code block:
from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "user_role_updated" and
    (
        openai_chatgpt_enterprise.audit_log.action_data.new_role == "account-owner" or
        openai_chatgpt_enterprise.audit_log.action_data.role == "account-owner"
    )
| keep
    _id, _version, _index, @timestamp, event.action, event.outcome, user.id, user.email, source.ip,
    source.geo.country_iso_code, openai_chatgpt_enterprise.audit_log.action_data.role,
    openai_chatgpt_enterprise.audit_log.action_data.new_role,
    openai_chatgpt_enterprise.audit_log.action_data.previous_role,
    openai_chatgpt_enterprise.audit_log.action_data.user_id,
    openai_chatgpt_enterprise.audit_log.action_privilege,
    openai_chatgpt_enterprise.audit_log.actor.type, data_stream.*

Install detection rules in Elastic Security

Detect OpenAI ChatGPT Enterprise Account Owner Role Assigned in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).