DET-MS-SEN-005 Microsoft Sentinel Network KQL Severity: High
Source-code volume to AI services
Detects large outbound transfers to AI service endpoints that statistically match source-code transmission, distinct from typical conversation traffic.
Rule
// Outbound transfer sizes consistent with code or document exfil
let llmDomains = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| summarize TotalBytes = sum(BytesSent), Connections = count()
by Domain, InitiatingProcessAccountUpn
| where TotalBytes > 1_000_000 // > 1 MB outbound to one user/domain in 24h
| order by TotalBytes desc// Outbound transfer sizes consistent with code or document exfil
let llmDomains = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| summarize TotalBytes = sum(BytesSent), Connections = count()
by Domain, InitiatingProcessAccountUpn
| where TotalBytes > 1_000_000 // > 1 MB outbound to one user/domain in 24h
| order by TotalBytes desc How it works
Heuristic for code or document exfil — typical chat traffic is much smaller. Tune the threshold to your environment; even small projects can exceed default chat conversation sizes.
Required data sources
- Defender for Endpoint (DeviceNetworkEvents) with BytesSent enrichment
Prerequisites
- BytesSent values populated (this varies by deployment; check before relying)
Expected volume
Low — most users do not exceed 1 MB upload to chat services in 24h.
False-positive guidance
Users uploading large reference documents legitimately will trip this. Triage rather than block.
Tuning steps
- Tune the 1 MB threshold against your environment baseline.
- Exclude sanctioned domains.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MEASURE-2.7
- ISO/IEC 42001: 8.3
- MITRE ATT&CK: T1041, T1567