OpenAI ChatGPT Enterprise Assistant Advises Credential Rotation After Suspected Exposure

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Assistant Advises Credential Rotation After Suspected Exposure

edit

Detects ChatGPT Enterprise assistant messages that recognize likely exposed secrets in chat and advise rotating, revoking, regenerating, invalidating, or deactivating credentials (API keys, access keys, passwords, tokens, and similar). Users or adversaries who paste live secrets into conversations create credential-exposure risk; the assistant’s rotation advice is a strong signal that a secret was present in the prior turns.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Resources: Investigation Guide
Rule Type: ES|QL
Tactic: Credential Access
Mitre Atlas: AML.T0055
Mitre Atlas: AML.T0057

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Assistant Advises Credential Rotation After Suspected Exposure

An assistant reply indicated a likely secret in the conversation and advised rotating or revoking it. This often follows a user pasting an API key, cloud access key, password, or token into chat.

Escalate when the prior user message contains a live secret, the conversation is shared, or Codex or connector activity follows. Close as a false positive when the assistant is only helping draft generic security guidance with no in-chat exposure.

Possible investigation steps

Read message and the surrounding user turns for openai_chatgpt_enterprise.conversation_message.conversation.id.
Determine whether a live credential was pasted; if so, identify the credential type and owning system.
Correlate with other credential-in-conversation alerts and any subsequent shares or downloads.
Check whether the same user repeated exposures across conversations.

False positive analysis

Drafting support replies or security runbooks that mention rotate or revoke guidance for API keys.
Hypothetical examples that do not include a real secret.

Response and remediation

If a live credential was exposed, rotate or revoke it, remove residual copies from shared conversations where possible, and review use of that credential after the message time.
Limit access to alerts and compliance logs that retain message text.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect conversation message compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

from logs-openai_chatgpt_enterprise.conversation_message-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
    openai_chatgpt_enterprise.conversation_message.message.author.type == "assistant" and
    message is not null
| eval Esql.message_text = to_lower(message)
| where
    (
        Esql.message_text like "*rotate*" or
        Esql.message_text like "*revoke*" or
        Esql.message_text like "*regenerate*" or
        Esql.message_text like "*invalidate*" or
        Esql.message_text like "*deactivate*"
    ) and
    (
        Esql.message_text like "*api key*" or
        Esql.message_text like "*access key*" or
        Esql.message_text like "*secret access key*" or
        Esql.message_text like "*aws secret*" or
        Esql.message_text like "*credential*" or
        Esql.message_text like "*password*" or
        Esql.message_text like "*secret key*" or
        Esql.message_text like "*auth token*"
    ) and
    (
        Esql.message_text like "*looks like*" or
        Esql.message_text like "*appears to be*" or
        Esql.message_text like "*you shared*" or
        Esql.message_text like "*you pasted*" or
        Esql.message_text like "*you posted*" or
        Esql.message_text like "*you provided*" or
        Esql.message_text like "*exposed*" or
        Esql.message_text like "*leaked*" or
        Esql.message_text like "*compromised*" or
        Esql.message_text like "*for security*" or
        Esql.message_text like "*treat them as exposed*" or
        Esql.message_text like "*treat it as exposed*"
    )
| keep
    _id,
    _version,
    _index,
    @timestamp,
    message,
    user.id,
    user.email,
    organization.id,
    openai_chatgpt_enterprise.conversation_message.conversation.id,
    openai_chatgpt_enterprise.conversation_message.conversation.title,
    openai_chatgpt_enterprise.conversation_message.message.author.type,
    openai_chatgpt_enterprise.conversation_message.message.id,
    data_stream.*

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
Technique:
- Name: Unsecured Credentials
- ID: T1552
- Reference URL: https://attack.mitre.org/techniques/T1552/

« OpenAI ChatGPT Enterprise User Activity From High Number of Countries OpenAI ChatGPT Enterprise Codex Prompt Containing Credentials »