ShadowAI Defense GitHub
← All detections
DET-MS-SEN-008 Microsoft Sentinel Network KQL Severity: High

Sentinel — Large payload upload to AI API endpoints

Detects large data uploads (file or POST body) to known AI API endpoints, distinguishing programmatic bulk data submission from interactive chat usage.

Rule

// Detect large payload uploads to AI API endpoints
// Targets API endpoints specifically, not general web UI access
let aiApiEndpoints = dynamic([
    'api.openai.com', 'api.anthropic.com', 'generativelanguage.googleapis.com',
    'api.mistral.ai', 'api.deepseek.com', 'api.perplexity.ai', 'api.cohere.com',
    'api.groq.com', 'api.together.xyz', 'api.fireworks.ai',
    'api.x.ai', 'dashscope.aliyuncs.com'
]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (aiApiEndpoints)
| where BytesSent > 500000  // > 500 KB per connection — well above typical prompt size
| summarize TotalBytesSent = sum(BytesSent),
            ConnectionCount = count(),
            AvgPayloadKB = round(avg(BytesSent) / 1024.0, 1),
            MaxPayloadKB = round(max(BytesSent) / 1024.0, 1),
            TargetAPIs = make_set(Domain, 10),
            FirstSeen = min(Timestamp),
            LastSeen = max(Timestamp)
          by InitiatingProcessAccountUpn, DeviceName
| extend TotalMB = round(TotalBytesSent / 1048576.0, 2)
| where TotalMB > 1  // total > 1 MB to API endpoints in 24h
| project-reorder InitiatingProcessAccountUpn, DeviceName, TotalMB, ConnectionCount, AvgPayloadKB, MaxPayloadKB, TargetAPIs
| order by TotalMB desc

How it works

Focuses specifically on AI API endpoints (api.openai.com, api.anthropic.com, etc.) rather than web UI domains, targeting programmatic usage. A typical interactive chat prompt is under 10 KB; payloads exceeding 500 KB per connection strongly suggest file uploads, bulk context injection, or automated data submission. The dual threshold (500 KB per connection AND 1 MB total per day) reduces noise while catching meaningful data egress. This detection is critical for identifying developers and power users who bypass web UI controls by accessing AI APIs directly via scripts, CLI tools, or custom integrations.

Required data sources

  • Microsoft Defender for Endpoint (DeviceNetworkEvents) with BytesSent enrichment

Prerequisites

  • Microsoft 365 E5 or Defender for Endpoint P2
  • Sentinel workspace with M365D connector
  • BytesSent field populated in DeviceNetworkEvents (verify — this varies by deployment)
  • API endpoint list maintained and updated as new AI APIs launch

Expected volume

Very low — 1-5 users per day in a typical org. Developers using AI APIs for legitimate work will appear; triage based on data volume and content type rather than auto-blocking.

False-positive guidance

Developers in approved AI pilot programs who use APIs legitimately will trigger this rule. Data science teams uploading training datasets to AI APIs for fine-tuning are another common FP. Maintain an allow-list of approved API users and correlate with DLP findings (DET-MS-PV-001) for content-aware prioritization.

Tuning steps

  1. Verify BytesSent is populated in your environment before deploying.
  2. Adjust per-connection threshold (default 500 KB) based on legitimate API usage patterns.
  3. Adjust daily total threshold (default 1 MB) based on approved automation workloads.
  4. Build an allow-list for approved API consumers (e.g., data science team service accounts).
  5. Add new AI API domains as services launch — review quarterly.

Framework mappings

  • NIST AI RMF: GOVERN-4.1, MEASURE-2.7
  • ISO/IEC 42001: 8.3
  • MITRE ATT&CK: T1041, T1567
  • NIST CSF: DE.CM-1, DE.CM-3

Related AI Controls Catalog entries