OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed

Last updated 8 days ago on 2026-10-09

Created 9 days ago on 2026-10-08

About

Detects the first ChatGPT Enterprise Codex plugin install for a given plugin display name and plugin name pair within the rule history window. Newly installed Codex plugins expand the tools and data sources available inside agent sessions; adversaries can enable unexpected connectors to persist access to mail, chat, or file systems after initial compromise.

Tags

Domain: GenAIPlatform: OpenAIData Source: OpenAI ChatGPT EnterpriseService: OpenAI ChatGPT EnterpriseUse Case: Threat DetectionUse Case: UEBARule Type: New TermsTactic: PersistenceTactic: CollectionMitre Atlas: AML.T0053Mitre Atlas: AML.T0085Language: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Software Extensions (T1176)(external, opens in a new tab or window)

Collection (TA0009)(external, opens in a new tab or window)

↳ Data from Information Repositories (T1213)(external, opens in a new tab or window)

False Positive Examples

Approved rollout of Codex plugins such as Slack, Gmail, or Google Drive for engineering or support teams. Confirm the plugin against your workspace connector inventory and change process before escalating.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-openai_chatgpt_enterprise.codex_log-*
Related Integrations: openai_chatgpt_enterprise(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "openai_chatgpt_enterprise.codex_log" and
    event.action: "plugin_installed" and
    organization.id: * and
    user.email: * and
    openai_chatgpt_enterprise.codex_log.event_details.plugin_display_name: * and
    openai_chatgpt_enterprise.codex_log.event_details.plugin_name: *

Install detection rules in Elastic Security

Detect OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).