Excessive Copilot Prompt Activity

# *Excessive Copilot Prompt Activity* ## Query Information #### MITRE ATT&CK Technique(s) | Technique ID | Title | Link | | --- | --- | --- | #### Description Detects when a user generates an unusually high number of prompts to Copilot within a short period (e.g., 50 prompts in an hour). This could indicate automated activity, data exfiltration attempts, or misuse of the Copilot service. #### Author <Optional> - **Name: Benjamin Zulliger** - **Github: https://github.com/benscha/KQLAdvancedHunting** - **LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/** ## Defender XDR ```KQL CopilotActivity | where RecordType == "CopilotInteraction" | extend LLM = parse_json(LLMEventData) | extend Messages = LLM.Messages | mv-expand Messages | where tostring(Messages.isPrompt) == "true" | summarize PromptCount = count() by ActorName, bin(TimeGenerated, 1h) | where PromptCount > 50 // adjust threshold ```

Explanation

This query is designed to detect unusual activity related to the use of Copilot, a tool that assists users by generating code or text based on prompts. Here's a simple breakdown of what the query does:

Data Source: It starts by looking at records from a data source called CopilotActivity, specifically those that are categorized as "CopilotInteraction".
Extracting Information: It extracts detailed information from a field called LLMEventData and focuses on the messages within this data.
Filtering Prompts: The query then filters these messages to identify only those that are prompts (i.e., requests made to Copilot to generate a response).
Counting Prompts: It counts the number of prompts made by each user (referred to as ActorName) within each hour.
Detecting Excessive Activity: Finally, it flags any user who has made more than 50 prompts in an hour, which could suggest automated activity, potential misuse, or attempts to extract data.

In summary, this query helps identify users who might be overusing or misusing the Copilot service by generating a large number of prompts in a short time frame.

KQL Search

Excessive Copilot Prompt Activity

Query

Explanation

Details

Actions