DET-MS-SEN-001 Microsoft Sentinel Network KQL Severity: Medium
Outbound traffic to consumer LLM domains
Detects connections from corporate endpoints to known consumer LLM service domains, indicating Shadow AI use.
Rule
// Detect connections to consumer LLM services
// Tune the watchlist 'ConsumerLLMDomains' to your policy
let llmDomains = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == 'ConnectionSuccess'
| where RemoteUrl has_any (llmDomains) or RemoteIPType == 'Public'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| summarize ConnectionCount = count(),
UniqueUsers = dcount(InitiatingProcessAccountUpn),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp),
Endpoints = make_set(DeviceName, 100)
by Domain, InitiatingProcessAccountUpn
| where ConnectionCount > 5
| project-reorder InitiatingProcessAccountUpn, Domain, ConnectionCount, FirstSeen, LastSeen, Endpoints// Detect connections to consumer LLM services
// Tune the watchlist 'ConsumerLLMDomains' to your policy
let llmDomains = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == 'ConnectionSuccess'
| where RemoteUrl has_any (llmDomains) or RemoteIPType == 'Public'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| summarize ConnectionCount = count(),
UniqueUsers = dcount(InitiatingProcessAccountUpn),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp),
Endpoints = make_set(DeviceName, 100)
by Domain, InitiatingProcessAccountUpn
| where ConnectionCount > 5
| project-reorder InitiatingProcessAccountUpn, Domain, ConnectionCount, FirstSeen, LastSeen, Endpoints How it works
Uses a Sentinel watchlist of consumer LLM domains (chat.openai.com, claude.ai, gemini.google.com, perplexity.ai, etc.) and identifies users whose endpoints have connected more than 5 times in 24 hours. Designed to detect repeated use rather than incidental visits. Pair with the watchlist 'ConsumerLLMDomains' (template provided in this repo).
Required data sources
- Microsoft Defender for Endpoint (DeviceNetworkEvents)
- Sentinel watchlist: ConsumerLLMDomains
Prerequisites
- Microsoft 365 E5 or Defender for Endpoint P2
- Sentinel workspace with M365D connector
- Watchlist created from /watchlists/ConsumerLLMDomains.csv in this repo
Expected volume
Moderate — for an org of 10k knowledge workers, expect 50–200 user matches per day before tuning. Drops to 10–30/day after policy + comms.
False-positive guidance
Some users may legitimately use approved tools through consumer URLs (e.g., a help-desk troubleshooting). Maintain an allow list of known approved use cases.
Tuning steps
- Adjust ConnectionCount threshold from 5 based on baseline.
- Add allow-list for users in approved AI pilot groups.
- Exclude IT and Security testing accounts.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MEASURE-2.7
- ISO/IEC 42001: 8.2, 8.3
- MITRE ATT&CK: T1567