KQL Search

Query Details

APIM AI Gateway - Prompt injection pattern allowed

APIM Prompt Injection Allowed

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| where Success == true or toint(ResultCode) between (200 .. 299)
| extend RequestBody=tostring(Properties["Request-Body"]), ResponseBody=tostring(Properties["Response-Body"])
| where isnotempty(RequestBody)
| extend RequestJson=parse_json(RequestBody), ResponseJson=parse_json(ResponseBody)
| extend Input=tostring(RequestJson.input), Instructions=tostring(RequestJson.instructions), Model=tostring(RequestJson.model), Tools=tostring(RequestJson.tools)
| extend Search=strcat(Input, " ", RequestBody)
| where Search matches regex @"(?i)(ignore (all|any|the|previous|prior|above).{0,40}instruction|disregard.{0,40}instruction|system prompt|developer mode|jailbreak|do anything now|you are now|act as.{0,30}(admin|administrator|system)|olvida.{0,40}instrucci)"
| extend Caller=coalesce(UserAuthenticatedId, UserId, ClientIP, "unknown"), PolicyMessage=tostring(ResponseJson.message), RequestId=tostring(Properties["Request Id"]), APIName=tostring(Properties["API Name"])
| project TimeGenerated, Signal="ALLOWED PROMPT INJECTION PATTERN", Caller, ResultCode, PolicyMessage, APIName, Name, Url, Model, Input, Instructions, Tools, RequestBody, ResponseBody, RequestId, OperationId, DurationMs

Explanation

This query is designed to detect potential security threats related to "prompt injection" in API Management (APIM) systems. Here's a simplified breakdown:

  • Purpose: The query identifies instances where certain suspicious patterns, like instruction overrides or jailbreak attempts, are present in the request body of successful API calls. These patterns could indicate attempts to manipulate or bypass system instructions.

  • Data Source: It uses data from Application Insights, specifically focusing on application requests.

  • Frequency: The query runs every hour and looks at data from the past hour.

  • Detection Logic:

    • It filters requests where the API call was successful (HTTP status codes 200-299).
    • It examines the request and response bodies for specific keywords or patterns that suggest prompt injection attempts (e.g., "ignore instruction", "system prompt", "jailbreak").
    • If such patterns are found, it collects various details about the request, such as the caller, API name, and request/response content.

  • Severity and Response: The severity of detected incidents is marked as high. When a potential threat is identified, an alert is generated, and an incident is created. The system can group related alerts into a single incident for easier management.

  • Entity Mapping: The query maps certain fields to entities like accounts, cloud applications, and URLs for better identification and tracking.

  • Tags and Metadata: The query is tagged for easy identification and is part of a scheduled process, running automatically at specified intervals.

Overall, this query helps in monitoring and identifying unauthorized attempts to manipulate API behavior through prompt injections, which is crucial for maintaining the security and integrity of API services.