OpenAI ChatGPT Enterprise Suspicious Gmail Discovery

  1[metadata]
  2creation_date = "2026/10/09"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5min_stack_comments = "field_extract (flattened field support) is available starting in 9.5.0, as a Technical Preview function; GA in 9.6.0."
  6min_stack_version = "9.5.0"
  7updated_date = "2026/10/09"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects ChatGPT Enterprise Gmail connector searches that look like sensitive discovery: attachment hunts across multiple
 13document types, or queries matching credential, financial, HR, or legal themes. Attackers abusing a linked Gmail
 14connector after session compromise often search mail for high-value content before exfiltration or send-as abuse.
 15"""
 16false_positives = [
 17    """
 18    HR, legal, finance, or IR users who legitimately search Gmail for attachments, payroll, or contract terms via
 19    ChatGPT.
 20    """,
 21]
 22from = "now-9m"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "OpenAI ChatGPT Enterprise Suspicious Gmail Discovery"
 26note = """## Triage and analysis
 27
 28### Investigating OpenAI ChatGPT Enterprise Suspicious Gmail Discovery
 29
 30A Gmail connector search matched attachment or document-type hunting, or sensitive themes (credentials, financial, HR,
 31or legal). That can indicate collection staging through ChatGPT after connector or session abuse.
 32
 33Escalate when searches are broad (`has:attachment` plus many `filename:` filters), credential keywords appear, or
 34nearby Gmail sends or Drive downloads follow. Close as a false positive for approved HR, legal, or finance research.
 35
 36#### Possible investigation steps
 37
 38- Review `Esql.email_search_query` and the boolean match flags on the alert.
 39- Correlate with Gmail send events, Google Drive downloads, or unusual authentication activity for the same user.
 40- Confirm whether Gmail connector use is approved for that user and whether the search matches their role.
 41- Check whether the same user recently linked the Gmail connector or created Codex access tokens.
 42
 43### False positive analysis
 44
 45- HR, legal, finance, or incident-response users refining attachment searches or payroll and contract lookups can match
 46  these patterns when using an approved Gmail connector.
 47
 48### Response and remediation
 49
 50- Revoke Gmail connector access if unauthorized, review retrieved mail and attachments, and treat exposed content per
 51  your data-incident process.
 52- Hunt for follow-on Gmail sends, Drive downloads, or conversation shares from the same user.
 53"""
 54references = [
 55    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 56    "https://platform.openai.com/docs/compliance",
 57]
 58risk_score = 47
 59rule_id = "b05745b3-4bab-42f3-8040-d26d42b8eec1"
 60setup = """## Setup
 61
 62This rule requires the OpenAI ChatGPT Enterprise integration to collect `app_log` events for the Gmail app
 63(`app_type: SERVICE`) with flattened `openai_chatgpt_enterprise.app_log.input` fields, including `query`.
 64
 65https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 66"""
 67severity = "medium"
 68tags = [
 69    "Domain: GenAI",
 70    "Platform: OpenAI",
 71    "Data Source: OpenAI ChatGPT Enterprise",
 72    "Service: OpenAI ChatGPT Enterprise",
 73    "Use Case: Threat Detection",
 74    "Resources: Investigation Guide",
 75    "Rule Type: ES|QL",
 76    "Tactic: Collection",
 77    "Tactic: Discovery",
 78    "Mitre Atlas: AML.T0053",
 79    "Mitre Atlas: AML.T0085",
 80]
 81timestamp_override = "event.ingested"
 82type = "esql"
 83
 84query = '''
 85from logs-openai_chatgpt_enterprise.app_log-* metadata _id, _version, _index
 86| where
 87    data_stream.dataset == "openai_chatgpt_enterprise.app_log" and
 88    openai_chatgpt_enterprise.app_log.app_name == "Gmail" and
 89    openai_chatgpt_enterprise.app_log.app_type == "SERVICE" and
 90    openai_chatgpt_enterprise.app_log.input is not null
 91| eval Esql.email_search_query = to_lower(field_extract(openai_chatgpt_enterprise.app_log.input, "query"))
 92| eval
 93    Esql.attachment_search = Esql.email_search_query rlike """.*has:attachment.*""",
 94    Esql.document_extension = Esql.email_search_query rlike """.*filename:(pdf|doc|docx|xls|xlsx|csv|ppt|pptx|txt|rtf|odt|ods|zip|7z|rar).*""",
 95    Esql.multiple_filetypes = Esql.email_search_query rlike """.*filename:[a-z0-9]+.*filename:[a-z0-9]+.*""",
 96    Esql.match_financial = Esql.email_search_query rlike """.*(payslip|paystub|payroll|salary|compensation|bonus|bank.account|swift|routing.number|invoice|tax.return|w2|w-2|1099).*""",
 97    Esql.match_hr = Esql.email_search_query rlike """.*(employment.contract|offer.letter|employment.agreement|employee.records|passport|national.insurance|social.security|ssn|date.of.birth|personal.data).*""",
 98    Esql.match_legal = Esql.email_search_query rlike """.*(confidential|restricted|internal.only|legal|settlement|merger|acquisition).*""",
 99    Esql.match_credentials = Esql.email_search_query rlike """.*(password|passwd|credential|api.key|secret.key|private.key|access.token|client.secret|recovery.code|backup.code|ssh.key).*"""
100| where
101    (Esql.attachment_search == true and (Esql.document_extension == true or Esql.multiple_filetypes == true)) or
102    Esql.match_credentials == true or
103    Esql.match_financial == true or
104    Esql.match_legal == true or
105    Esql.match_hr == true
106| keep
107    _id, _version, _index, @timestamp, user.id, user.email,
108    Esql.email_search_query,
109    Esql.attachment_search,
110    Esql.document_extension,
111    Esql.multiple_filetypes,
112    Esql.match_financial,
113    Esql.match_hr,
114    Esql.match_legal,
115    Esql.match_credentials,
116    openai_chatgpt_enterprise.app_log.input,
117    data_stream.*
118'''
119
120
121[[rule.threat]]
122framework = "MITRE ATT&CK"
123[[rule.threat.technique]]
124id = "T1213"
125name = "Data from Information Repositories"
126reference = "https://attack.mitre.org/techniques/T1213/"
127
128
129[rule.threat.tactic]
130id = "TA0009"
131name = "Collection"
132reference = "https://attack.mitre.org/tactics/TA0009/"
133[[rule.threat]]
134framework = "MITRE ATT&CK"
135[[rule.threat.technique]]
136id = "T1083"
137name = "File and Directory Discovery"
138reference = "https://attack.mitre.org/techniques/T1083/"
139
140
141[rule.threat.tactic]
142id = "TA0007"
143name = "Discovery"
144reference = "https://attack.mitre.org/tactics/TA0007/"
145[[rule.threat_mappings]]
146framework = "MITRE ATLAS"
147version = "2026.08"
148[[rule.threat_mappings.threat]]
149framework = "MITRE ATLAS"
150[[rule.threat_mappings.threat.technique]]
151id = "AML.T0053"
152name = "AI Agent Tool Invocation"
153reference = "https://atlas.mitre.org/techniques/AML.T0053/"
154
155
156[rule.threat_mappings.threat.tactic]
157id = "AML.TA0005"
158name = "Execution"
159reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
160[[rule.threat_mappings.threat]]
161framework = "MITRE ATLAS"
162[[rule.threat_mappings.threat.technique]]
163id = "AML.T0085"
164name = "Data from AI Services"
165reference = "https://atlas.mitre.org/techniques/AML.T0085/"
166
167
168[rule.threat_mappings.threat.tactic]
169id = "AML.TA0009"
170name = "Collection"
171reference = "https://atlas.mitre.org/tactics/AML.TA0009/"
172
173[rule.investigation_fields]
174field_names = [
175    "@timestamp",
176    "user.email",
177    "Esql.email_search_query",
178    "Esql.attachment_search",
179    "Esql.document_extension",
180    "Esql.multiple_filetypes",
181    "Esql.match_credentials",
182    "Esql.match_financial",
183    "Esql.match_hr",
184    "Esql.match_legal",
185    "openai_chatgpt_enterprise.app_log.input",
186]