Potential Azure OpenAI Model Theft

Last updated 3 months ago on 2025-09-25

Created 10 months ago on 2025-02-25

About

Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are unusual during model interactions.

Tags: Domain: LLMData Source: Azure OpenAIData Source: Azure Event HubsUse Case: Model TheftMitre Atlas: T0044Language: esql
Severity: medium
Risk Score: 47
False Positive Examples: Authorized model trainingLegitimate high volume data exchanges during scheduled updates
License: Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack: Prebuilt Security Detection Rules
Related Integrations: azure_openai(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗from logs-azure_openai.logs-*
| where
    azure.open_ai.operation_name == "ListKey" and
    azure.open_ai.category == "Audit"
| keep
    @timestamp,
    azure.open_ai.operation_name,
    azure.open_ai.category,
    azure.resource.group,
    azure.resource.name,
    azure.open_ai.properties.response_length
| stats
    Esql.event_count = count(*),
    Esql.azure_open_ai_properties_response_length_max = max(azure.open_ai.properties.response_length)
  by
    azure.resource.group,
    azure.resource.name
| where
    Esql.event_count >= 100 or
    Esql.azure_open_ai_properties_response_length_max >= 1000000
| sort
    Esql.event_count desc

Install detection rules in Elastic Security

Detect Potential Azure OpenAI Model Theft in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).