OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed

Detects the first ChatGPT Enterprise Codex plugin install for a given plugin display name and plugin name pair within the rule history window. Newly installed Codex plugins expand the tools and data sources available inside agent sessions; adversaries can enable unexpected connectors to persist access to mail, chat, or file systems after initial compromise.

Rule type: new_terms

Rule indices:

logs-openai_chatgpt_enterprise.codex_log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Use Case: UEBA
Resources: Investigation Guide
Rule Type: New Terms
Tactic: Persistence
Tactic: Collection
Mitre Atlas: AML.T0053
Mitre Atlas: AML.T0085

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed

A Codex plugin was installed for the first time for this plugin pair within the rule history window. Plugins can add connectors that pull mail, chat, or file content into Codex sessions.

Escalate when the plugin is not on the approved inventory, the installing user is unexpected, or nearby activity shows sensitive search bursts, MCP tool abuse, or access-token creation. Close as a false positive for approved connector rollouts.

Possible investigation steps

Record plugin_display_name, plugin_name, and the installing user (user.email / user.id).
Confirm whether the plugin is approved in your ChatGPT Enterprise or Codex workspace inventory.
Review nearby Codex and app-log activity for the same user for MCP calls, Drive or Slack query bursts, or credential exposure.
Search for the same plugin installed by other users to distinguish org-wide rollout from a single anomalous install.

False positive analysis

Planned enablement of common plugins (Slack, Gmail, Google Drive) during onboarding or team pilots.

Response and remediation

Remove unauthorized plugins, revoke related OAuth links, and review data accessed after the install.
If sensitive data may have been retrieved, follow your data-incident process for the session window.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect Codex compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

data_stream.dataset: "openai_chatgpt_enterprise.codex_log" and
    event.action: "plugin_installed" and
    organization.id: * and
    user.email: * and
    openai_chatgpt_enterprise.codex_log.event_details.plugin_display_name: * and
    openai_chatgpt_enterprise.codex_log.event_details.plugin_name: *

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Software Extensions
- ID: T1176
- Reference URL: https://attack.mitre.org/techniques/T1176/
Tactic:
- Name: Collection
- ID: TA0009
- Reference URL: https://attack.mitre.org/tactics/TA0009/
Technique:
- Name: Data from Information Repositories
- ID: T1213
- Reference URL: https://attack.mitre.org/techniques/T1213/

« OpenAI ChatGPT Enterprise Codex Access Token Created OpenAI ChatGPT Enterprise Custom Agent Published »