DET-MS-SEN-003 Microsoft Sentinel Network KQL Severity: High
Mass adoption of unsanctioned AI tool
Detects when an unsanctioned AI service exceeds a user-count threshold within a short window, indicating organic adoption that warrants program-level response.
Rule
// Mass-adoption pattern: an unsanctioned LLM domain exceeds 50 users in 7 days
let llmDomains = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
let sanctioned = _GetWatchlist('SanctionedAIServices') | project SearchKey;
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| where Domain !in (sanctioned)
| summarize Users = dcount(InitiatingProcessAccountUpn),
Connections = count(),
Span = max(Timestamp) - min(Timestamp)
by Domain
| where Users >= 50
| order by Users desc// Mass-adoption pattern: an unsanctioned LLM domain exceeds 50 users in 7 days
let llmDomains = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
let sanctioned = _GetWatchlist('SanctionedAIServices') | project SearchKey;
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| where Domain !in (sanctioned)
| summarize Users = dcount(InitiatingProcessAccountUpn),
Connections = count(),
Span = max(Timestamp) - min(Timestamp)
by Domain
| where Users >= 50
| order by Users desc How it works
Identifies viral-adoption events that exceed individual-response capacity. Triggers RB-003 (program-level response) rather than per-user warnings.
Required data sources
- Microsoft Defender for Endpoint (DeviceNetworkEvents)
- Sentinel watchlists: ConsumerLLMDomains, SanctionedAIServices
Prerequisites
- Watchlists deployed and current
Expected volume
Rare — 0–3 events per month. Each is a program-level decision.
False-positive guidance
Verify the domain is actually an LLM service (cross-check the service catalog).
Tuning steps
- Adjust 50-user threshold to your organization's scale.
- Adjust 7-day window to taste.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MANAGE-2.2
- ISO/IEC 42001: 8.2, 8.4
- NIST CSF: DE.AE-2