DET-MS-SEN-004 Microsoft Sentinel Network KQL Severity: Medium
API-key issuance for unsanctioned LLM platforms
Detects egress to LLM API endpoints (rather than chat endpoints), indicating script/agent-based use that may bypass user-facing controls.
Rule
// API-endpoint connections from non-developer environments
let apiEndpoints = dynamic([
'api.openai.com', 'api.anthropic.com', 'generativelanguage.googleapis.com',
'api.mistral.ai', 'api.x.ai', 'api.deepseek.com', 'dashscope.aliyuncs.com'
]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (apiEndpoints)
| join kind=leftouter (DeviceInfo | summarize arg_max(Timestamp, *) by DeviceName) on DeviceName
| where MachineGroup !in ('Developer Workstations', 'AI Engineering')
| summarize Connections = count(), FirstSeen = min(Timestamp)
by Domain, InitiatingProcessAccountUpn, DeviceName, MachineGroup// API-endpoint connections from non-developer environments
let apiEndpoints = dynamic([
'api.openai.com', 'api.anthropic.com', 'generativelanguage.googleapis.com',
'api.mistral.ai', 'api.x.ai', 'api.deepseek.com', 'dashscope.aliyuncs.com'
]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (apiEndpoints)
| join kind=leftouter (DeviceInfo | summarize arg_max(Timestamp, *) by DeviceName) on DeviceName
| where MachineGroup !in ('Developer Workstations', 'AI Engineering')
| summarize Connections = count(), FirstSeen = min(Timestamp)
by Domain, InitiatingProcessAccountUpn, DeviceName, MachineGroup How it works
API-endpoint traffic from non-developer machines typically signals script-based or agent-based use without sanctioned governance.
Required data sources
- Defender for Endpoint (DeviceNetworkEvents, DeviceInfo)
Prerequisites
- Defender for Endpoint P2 or M365 E5
- Device groups tagged with MachineGroup metadata
Expected volume
Low — most knowledge workers do not call LLM APIs directly.
False-positive guidance
Some Office add-ins call LLM APIs natively; tag them as sanctioned MachineGroups or processes.
Tuning steps
- Maintain MachineGroup tags accurately.
- Tune apiEndpoints list quarterly.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MEASURE-2.7
- ISO/IEC 42001: 8.2, 8.3
- MITRE ATT&CK: T1567