ShadowAI Defense GitHub
← All detections
DET-MS-SEN-007 Microsoft Sentinel Network KQL Severity: Medium

Sentinel — After-hours AI service access

Detects access to consumer AI services outside of defined business hours, which may indicate employees circumventing daytime monitoring controls or engaging in unauthorized data processing during off-peak periods.

Rule

// Detect AI service access outside business hours (configurable per timezone)
let llmDomains = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
let businessStart = 7;  // 7 AM local time
let businessEnd = 19;   // 7 PM local time
let workDays = dynamic(['Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday']);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| extend LocalHour = hourofday(Timestamp)  // adjust with datetime_utc_to_local() if timezone info available
| extend DayOfWeek = dayofweek(Timestamp)
| extend DayName = case(
    DayOfWeek == 0d, 'Sunday',
    DayOfWeek == 1d, 'Monday',
    DayOfWeek == 2d, 'Tuesday',
    DayOfWeek == 3d, 'Wednesday',
    DayOfWeek == 4d, 'Thursday',
    DayOfWeek == 5d, 'Friday',
    DayOfWeek == 6d, 'Saturday',
    'Unknown')
| where LocalHour < businessStart or LocalHour >= businessEnd or DayName !in (workDays)
| summarize AfterHoursConnections = count(),
            DistinctDomains = dcount(Domain),
            Domains = make_set(Domain, 10),
            EarliestAccess = min(Timestamp),
            LatestAccess = max(Timestamp),
            Devices = make_set(DeviceName, 10)
          by InitiatingProcessAccountUpn
| where AfterHoursConnections > 3
| project-reorder InitiatingProcessAccountUpn, AfterHoursConnections, DistinctDomains, Domains, EarliestAccess, LatestAccess

How it works

Identifies users accessing consumer AI services outside defined business hours (default: before 7 AM or after 7 PM, and weekends). After-hours AI usage is a behavioral indicator worth monitoring because: (1) it may indicate employees working with sensitive data when they believe they are less observed, (2) automated scripts or integrations running overnight against AI APIs, or (3) personal AI usage on corporate devices during off hours. The threshold of 3 connections filters out incidental access.

Required data sources

  • Microsoft Defender for Endpoint (DeviceNetworkEvents)
  • Sentinel watchlist: ConsumerLLMDomains

Prerequisites

  • Microsoft 365 E5 or Defender for Endpoint P2
  • Sentinel workspace with M365D connector
  • Watchlist created from /watchlists/ConsumerLLMDomains.csv
  • Organization business hours defined (adjust businessStart/businessEnd in query)

Expected volume

Low to moderate — 5-25 users per day in a 10k-seat org. Higher in globally distributed organizations where timezone alignment is complex.

False-positive guidance

Global organizations with employees in multiple timezones will generate significant noise unless timezone logic is refined. Shift workers and on-call staff will legitimately access AI tools outside standard hours. Executives and senior staff often work extended hours. Consider building a per-user timezone mapping table for multi-timezone orgs.

Tuning steps

  1. Adjust businessStart and businessEnd to match organizational norms.
  2. Build a timezone lookup table for global organizations (join on user location from Entra ID).
  3. Exclude known shift-work departments or on-call groups.
  4. Increase the AfterHoursConnections threshold if base volume is high.
  5. Correlate with DET-MS-SEN-005 to prioritize after-hours access involving large data uploads.

Framework mappings

  • NIST AI RMF: GOVERN-4.1, MEASURE-2.7
  • ISO/IEC 42001: 8.2
  • MITRE ATT&CK: T1029
  • NIST CSF: DE.CM-1, DE.AE-1

Related AI Controls Catalog entries