OpenAI ChatGPT Enterprise Jailbreak Prompt Heuristics

  1[metadata]
  2creation_date = "2026/10/23"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/23"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise user messages that combine two or more common jailbreak techniques: overriding prior or
 11system instructions, switching the assistant into an unrestricted persona or mode (for example DAN or developer mode),
 12asking it to operate without safety restrictions or filters, or asking it to reveal its system prompt. Jailbreak prompts
 13stack these techniques to talk the model out of its safety policy, and a user doing so in a managed workspace may be
 14attempting to generate prohibited content or to probe the workspace's controls. Requiring more than one technique keeps
 15documents that merely quote a single jailbreak phrase from alerting.
 16"""
 17false_positives = [
 18    """
 19    Security, red team, and AI safety staff who paste jailbreak samples, threat models, or prompt-injection research
 20    into ChatGPT for analysis. Exclude these users or the workspaces they use for this work.
 21    """,
 22    """
 23    Long documents such as design docs or detection specs that describe several jailbreak techniques together. Review
 24    `Esql.message_length` and the message context before escalating.
 25    """,
 26]
 27from = "now-9m"
 28language = "esql"
 29license = "Elastic License v2"
 30name = "OpenAI ChatGPT Enterprise Jailbreak Prompt Heuristics"
 31note = """## Triage and analysis
 32
 33### Investigating OpenAI ChatGPT Enterprise Jailbreak Prompt Heuristics
 34
 35A ChatGPT Enterprise user message matched two or more jailbreak technique categories. The categories are tracked
 36separately in `Esql.has_instruction_override`, `Esql.has_persona_switch`, `Esql.has_restriction_removal`, and
 37`Esql.has_system_prompt_extraction`, and their total is `Esql.indicator_count`.
 38
 39### Possible investigation steps
 40
 41- Read `message` and decide whether the user is attempting a jailbreak or is quoting, analyzing, or documenting one.
 42  A short prompt addressed to the assistant is more suspicious than a long pasted document.
 43- Review the rest of the conversation using `openai_chatgpt_enterprise.conversation_message.conversation.id`. Look
 44  at whether the assistant refused, and whether the user rephrased and retried.
 45- Check `user.email` and `user.id` for related alerts, such as OpenAI ChatGPT Enterprise Repeated Assistant Refusals,
 46  credential sharing in conversations, or unusual connector use.
 47- Determine whether the user belongs to a team that legitimately researches jailbreaks or prompt injection.
 48
 49### False positive analysis
 50
 51- AI safety and security researchers analyzing jailbreak techniques. Add exceptions for these users.
 52- Documentation that lists several jailbreak phrases. These messages tend to be long and descriptive rather than
 53  addressed to the assistant.
 54
 55### Response and remediation
 56
 57- If the attempt is not sanctioned, follow the organization's acceptable use process for the user.
 58- Review whether any content produced in the conversation should be reported or removed, and whether workspace
 59  policies or custom GPT instructions need tightening.
 60"""
 61references = [
 62    "https://atlas.mitre.org/techniques/AML.T0054",
 63    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 64]
 65risk_score = 47
 66rule_id = "7308b57c-91ed-4c2b-8c74-e0aca24d1b6e"
 67setup = """## Setup
 68
 69This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch, including
 70the `conversation_message` data stream.
 71https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 72"""
 73severity = "medium"
 74tags = [
 75    "Domain: GenAI",
 76    "Platform: OpenAI",
 77    "Data Source: OpenAI ChatGPT Enterprise",
 78    "Service: OpenAI ChatGPT Enterprise",
 79    "Use Case: Policy Violation",
 80    "Use Case: Threat Detection",
 81    "Resources: Investigation Guide",
 82    "Rule Type: ES|QL",
 83    "Tactic: Defense Evasion",
 84    "Mitre Atlas: AML.T0051",
 85    "Mitre Atlas: AML.T0054",
 86]
 87timestamp_override = "event.ingested"
 88type = "esql"
 89
 90query = '''
 91from logs-openai_chatgpt_enterprise.conversation_message-* metadata _id, _version, _index
 92| where
 93    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
 94    openai_chatgpt_enterprise.conversation_message.message.author.type == "user" and
 95    message is not null
 96| eval
 97    Esql.message_text = to_lower(message),
 98    Esql.message_length = length(message)
 99| eval
100    Esql.has_instruction_override = case(
101        Esql.message_text rlike """.*(ignore|disregard|forget|override) (all |any )?(of )?(your |the |my )?(previous|prior|above|earlier|original|system|developer) (instructions|prompts?|rules|guidelines|directives|programming).*""" or
102        Esql.message_text rlike """.*(ignore|disregard|forget) (all |any )?(of )?(the )?(instructions|rules|guidelines) (you (got|were given|received)|given to you).*""" or
103        Esql.message_text like "*forget everything you were told*",
104        1, 0
105    ),
106    Esql.has_persona_switch = case(
107        Esql.message_text rlike """.*(you are|act as|pretend (to be|you are)|roleplay as|from now on,? you are) (now )?(dan|stan|dude|aim|an? (unfiltered|unrestricted|uncensored|amoral) (ai|assistant|model|chatbot)).*""" or
108        Esql.message_text like "*do anything now*" or
109        Esql.message_text rlike """.*(enable|enter|activate|switch to) (developer|god|jailbreak|unrestricted|dan) mode.*""",
110        1, 0
111    ),
112    Esql.has_restriction_removal = case(
113        Esql.message_text rlike """.*(without|with no|free (of|from)|ignoring) (any |your |all )?(ethical |content |safety |moral )?(restrictions|filters|guidelines|limitations|censorship).*""" or
114        Esql.message_text rlike """.*(bypass|disable|turn off|ignore) (your |the |all )?(safety|content) (filters?|polic(y|ies)|guidelines|guardrails).*""" or
115        Esql.message_text rlike """.*(do not|does not|don't|doesn't) have to (abide by|follow|obey) (the |any |your )?(rules|guidelines|policies).*""",
116        1, 0
117    ),
118    Esql.has_system_prompt_extraction = case(
119        Esql.message_text rlike """.*(reveal|print|show|repeat|output) (me )?(your |the )?(full |hidden |original )?(system prompt|initial instructions|hidden instructions).*""",
120        1, 0
121    )
122| eval
123    Esql.indicator_count = Esql.has_instruction_override + Esql.has_persona_switch + Esql.has_restriction_removal + Esql.has_system_prompt_extraction
124| where Esql.indicator_count >= 2
125| keep
126    _id,
127    _version,
128    _index,
129    @timestamp,
130    message,
131    user.id,
132    user.email,
133    openai_chatgpt_enterprise.conversation_message.conversation.id,
134    openai_chatgpt_enterprise.conversation_message.conversation.title,
135    openai_chatgpt_enterprise.conversation_message.message.id,
136    Esql.message_length,
137    Esql.indicator_count,
138    Esql.has_instruction_override,
139    Esql.has_persona_switch,
140    Esql.has_restriction_removal,
141    Esql.has_system_prompt_extraction,
142    data_stream.*
143'''
144
145
146[[rule.threat]]
147framework = "MITRE ATT&CK"
148[[rule.threat.technique]]
149id = "T1562"
150name = "Impair Defenses"
151reference = "https://attack.mitre.org/techniques/T1562/"
152
153
154[rule.threat.tactic]
155id = "TA0005"
156name = "Defense Evasion"
157reference = "https://attack.mitre.org/tactics/TA0005/"
158[[rule.threat_mappings]]
159framework = "MITRE ATLAS"
160version = "2026.09"
161[[rule.threat_mappings.threat]]
162framework = "MITRE ATLAS"
163[[rule.threat_mappings.threat.technique]]
164id = "AML.T0051"
165name = "LLM Prompt Injection"
166reference = "https://atlas.mitre.org/techniques/AML.T0051/"
167
168
169[rule.threat_mappings.threat.tactic]
170id = "AML.TA0005"
171name = "Execution"
172reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
173[[rule.threat_mappings.threat]]
174framework = "MITRE ATLAS"
175[[rule.threat_mappings.threat.technique]]
176id = "AML.T0054"
177name = "LLM Jailbreak"
178reference = "https://atlas.mitre.org/techniques/AML.T0054/"
179
180
181[rule.threat_mappings.threat.tactic]
182id = "AML.TA0007"
183name = "Defense Evasion"
184reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
185
186[rule.alert_suppression]
187group_by = ["user.id", "openai_chatgpt_enterprise.conversation_message.conversation.id"]
188missing_fields_strategy = "suppress"
189
190[rule.investigation_fields]
191field_names = [
192    "@timestamp",
193    "user.id",
194    "user.email",
195    "message",
196    "openai_chatgpt_enterprise.conversation_message.conversation.id",
197    "openai_chatgpt_enterprise.conversation_message.conversation.title",
198    "Esql.message_length",
199    "Esql.indicator_count",
200]
201
202[rule.alert_suppression.duration]
203unit = "h"
204value = 1