OpenAI ChatGPT Enterprise Conversation Message Containing Credentials

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Conversation Message Containing Credentials

edit

Detects ChatGPT Enterprise conversation messages whose text matches known credential patterns (cloud keys, GitHub tokens, private keys, Slack/SendGrid tokens, Stripe/OpenAI/Anthropic keys, Vault/Docker tokens, JWTs, or Azure storage keys). Secrets pasted into chats can be retained in compliance logs and model context.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Resources: Investigation Guide
Rule Type: ES|QL
Tactic: Credential Access
Mitre Atlas: AML.T0055
Mitre Atlas: AML.T0057

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Conversation Message Containing Credentials

A conversation message matched a known credential pattern. Secrets pasted into ChatGPT can be retained in compliance logs and model context, and may later appear in shares or exports.

Escalate when the value appears live, when the conversation is shared externally, or when downloads follow the message. Close as a false positive for clearly synthetic or documentation examples.

Possible investigation steps

Read message on the alert and decide whether the match is a live secret, an example key, or incidental text.
Identify the user and conversation (openai_chatgpt_enterprise.conversation_message.conversation.id / title).
Look for nearby conversation shares, file downloads, or Codex activity from the same user.
Check whether the conversation was shared outside the intended audience after the message time.

False positive analysis

Documentation samples and intentional prompt-security tests can match token patterns. Confirm the value is live before rotating it.

Response and remediation

If the credential is live, rotate or revoke it and remove residual copies from shared conversations where possible.
Review subsequent shares and downloads for the same conversation.
Limit access to alerts and compliance logs that retain message text.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

from logs-openai_chatgpt_enterprise.conversation_message-* metadata _id, _version, _index
| eval Esql.message_text = coalesce(message, "")
| where
    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
    Esql.message_text is not null and
    Esql.message_text != "" and
    not Esql.message_text like "*AKIAIOSFODNN7EXAMPLE*" and
    not Esql.message_text like "*ASIAIOSFODNN7EXAMPLE*" and
    not Esql.message_text like "*ghp_example*" and
    not Esql.message_text like "*sk-ant-api03-test*" and
    (
        Esql.message_text rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*""" or
        Esql.message_text rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*""" or
        Esql.message_text rlike """.*github_pat_[A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*""" or
        Esql.message_text rlike """.*xox[baprs]-[0-9]+-[0-9]+-[A-Za-z0-9]+.*""" or
        Esql.message_text rlike """.*sk_live_[A-Za-z0-9]+.*""" or
        Esql.message_text rlike """.*AIza[-A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*npm_[A-Za-z0-9]{36}.*""" or
        Esql.message_text rlike """.*sk-ant-[A-Za-z0-9-]+.*""" or
        Esql.message_text rlike """.*sk-[A-Za-z0-9]{20,}.*""" or
        Esql.message_text rlike """.*hvs[.][A-Za-z0-9]+.*""" or
        Esql.message_text rlike """.*dckr_pat_[-A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*SG[.][-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*(AccountKey=|SharedAccessKey=)[-A-Za-z0-9+/=]+.*""" or
        Esql.message_text rlike """.*eyJ[-A-Za-z0-9_]+[.]eyJ[-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*"""
    )
| keep
    _id, _version, _index, @timestamp, message, user.id, user.email,
    openai_chatgpt_enterprise.conversation_message.conversation.id,
    openai_chatgpt_enterprise.conversation_message.conversation.title,
    openai_chatgpt_enterprise.conversation_message.message.author.type,
    openai_chatgpt_enterprise.conversation_message.message.id,
    data_stream.*

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
Technique:
- Name: Unsecured Credentials
- ID: T1552
- Reference URL: https://attack.mitre.org/techniques/T1552/

« OpenAI ChatGPT Enterprise Codex Prompt Containing Credentials OpenAI ChatGPT Enterprise Multiple Authentication Failures »