OpenAI

Panther #

• OpenAI Admin Role Assignment source high: Detects when an admin or owner role is assigned to a user or group in OpenAI. Admin and owner roles grant elevated privileges that allow significant control over the organization, including managing users, API keys, billing, and security settings. Unauthorized or unexpected admin role assignments can indicate: - Privilege escalation attempts - Insider threats - Compromised administrator accounts - Policy violations This rule alerts on all admin role assignments for visibility and audit purposes.T1078, T1098, T1098.003
• OpenAI Anomalous API Key Activity source medium: Detects anomalous OpenAI API key activity indicative of potential key compromise, unauthorized access, or preparation for malicious misuse (e.g., C2, phishing, automation). OpenAI API keys provide programmatic access to powerful LLM capabilities. Abuse or compromise of these keys enables attackers to blend malicious activity into legitimate cloud traffic, bypassing traditional network-based detections. This rule alerts on: - API keys created or updated with elevated or unrestricted permissions (all, models:write, organization:write, api_keys:write, admin)T1071, T1078, T1098, T1550
• OpenAI Credential Stuffing source medium: Detects credential stuffing attacks against OpenAI accounts by tracking the number of distinct source IP addresses submitting failed login attempts against the same email address within a short timeframe. Unlike brute force from a single IP, credential stuffing distributes attempts across many IPs to evade rate limiting. This rule complements OpenAI.BruteForce.Login.Success.Group, which confirms account compromise once a successful login follows the failures.T1110.004
• OpenAI Failed Login (Base Rule) source informational: Base rule for detecting OpenAI failed login attempts. This rule is used primarily as a building block for correlation rules and does not generate alerts on its own.
• OpenAI IP Allowlist Configuration Changes source medium: Detects changes to OpenAI IP allowlist configurations including creation, updates, deletion, activation, and deactivation. IP allowlists restrict API and console access to specific IP addresses or CIDR ranges, providing network-level access control. Changes to IP allowlists can indicate: - Security control removal (deletion/deactivation) - CRITICAL - Addition of dangerous IPs like 0.0.0.0 (updates) - HIGH - Configuration changes for visibility (creation/activation) - MEDIUM Unauthorized modifications can expose the organization to unauthorized access, bypass network security controls, or indicate preparation for malicious activity.T1685, T1686.001
• OpenAI SCIM Configuration Change source medium: Detects when SCIM (System for Cross-domain Identity Management) is enabled or disabled in an OpenAI organization. SCIM provides automated user provisioning and deprovisioning from identity providers (IdP) to OpenAI. Disabling SCIM can: - Bypass identity governance and access control policies - Allow orphaned accounts to persist after employee offboarding - Indicate an attempt to maintain unauthorized access - Violate compliance requirements for automated access management Enabling SCIM should be monitored for visibility into identity integration changes.T1098, T1685
• OpenAI Successful Login (Base Rule) source informational: Base rule for detecting OpenAI successful login events. This rule is used primarily as a building block for correlation rules and does not generate alerts on its own.