Potentially Ungoverned AI Domains Such As Chatgpt
Query
//This Query looks for usage of ungoverned AI Usage by using DeviceNetworkEvents
let UngoverenedAI_IOCs = externaldata(type: string, IndicatorValue: string)[@"https://raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/PotentiallyUngovernedAITools.csv"] with (format="csv", ignoreFirstRecord=True);
let DomainList = UngoverenedAI_IOCs
| project IndicatorValue;
DeviceNetworkEvents
| where TimeGenerated > ago(90d) //| where Timestamp > ago(30d) - if using Advanced Huntng use Timestamp instead of TimeGenerated
| where RemoteUrl in~(DomainList )
| summarize count() by RemoteUrl
// After Hunting visit https://github.com/jkerai1/SoftwareCertificates/tree/main/Bulk-IOC-CSVs, download the CSV and consider uploading to MDE to block all domains. Remove any results that are legitimate usage.Explanation
This query is designed to identify the use of potentially unregulated AI tools by analyzing network events on devices. Here's a simple breakdown of what it does:
-
Load Indicators of Compromise (IOCs): It retrieves a list of potentially unregulated AI tools from an external CSV file hosted on GitHub. This list contains domain names that are considered suspicious.
-
Extract Domain List: It extracts the domain names from the CSV file to create a list of domains to watch for in network events.
-
Filter Network Events: It examines network events from the past 90 days to see if any of these events involve connections to the domains in the suspicious list. (Note: If using Advanced Hunting, the query suggests using "Timestamp" instead of "TimeGenerated" for filtering.)
-
Count Occurrences: It counts how many times each suspicious domain appears in the network events.
-
Next Steps: After identifying these domains, it suggests visiting the GitHub repository to download the CSV file and consider uploading it to Microsoft Defender for Endpoint (MDE) to block these domains. It also advises removing any domains from the list that are found to be legitimate.
Details
Jay Kerai
Released: February 14, 2025
Tables
Keywords
Operators