OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed

  1[metadata]
  2creation_date = "2026/10/08"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the first ChatGPT Enterprise Codex plugin install for a given plugin display name and plugin name pair within
 11the rule history window. Newly installed Codex plugins expand the tools and data sources available inside agent
 12sessions; adversaries can enable unexpected connectors to persist access to mail, chat, or file systems after initial
 13compromise.
 14"""
 15false_positives = [
 16    """
 17    Approved rollout of Codex plugins such as Slack, Gmail, or Google Drive for engineering or support teams. Confirm
 18    the plugin against your workspace connector inventory and change process before escalating.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-openai_chatgpt_enterprise.codex_log-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed"
 26note = """## Triage and analysis
 27
 28### Investigating OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed
 29
 30A Codex plugin was installed for the first time for this plugin pair within the rule history window. Plugins can add
 31connectors that pull mail, chat, or file content into Codex sessions.
 32
 33Escalate when the plugin is not on the approved inventory, the installing user is unexpected, or nearby activity shows
 34sensitive search bursts, MCP tool abuse, or access-token creation. Close as a false positive for approved connector
 35rollouts.
 36
 37#### Possible investigation steps
 38
 39- Record `plugin_display_name`, `plugin_name`, and the installing user (`user.email` / `user.id`).
 40- Confirm whether the plugin is approved in your ChatGPT Enterprise or Codex workspace inventory.
 41- Review nearby Codex and app-log activity for the same user for MCP calls, Drive or Slack query bursts, or credential
 42  exposure.
 43- Search for the same plugin installed by other users to distinguish org-wide rollout from a single anomalous install.
 44
 45### False positive analysis
 46
 47- Planned enablement of common plugins (Slack, Gmail, Google Drive) during onboarding or team pilots.
 48
 49### Response and remediation
 50
 51- Remove unauthorized plugins, revoke related OAuth links, and review data accessed after the install.
 52- If sensitive data may have been retrieved, follow your data-incident process for the session window.
 53"""
 54references = [
 55    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 56    "https://platform.openai.com/docs/compliance",
 57]
 58risk_score = 47
 59rule_id = "8f7fbc33-3fcc-4bf7-bd92-853f9c0f3a3c"
 60setup = """## Setup
 61
 62This rule requires the OpenAI ChatGPT Enterprise integration to collect Codex compliance logs into Elasticsearch.
 63
 64https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 65"""
 66severity = "medium"
 67tags = [
 68    "Domain: GenAI",
 69    "Platform: OpenAI",
 70    "Data Source: OpenAI ChatGPT Enterprise",
 71    "Service: OpenAI ChatGPT Enterprise",
 72    "Use Case: Threat Detection",
 73    "Use Case: UEBA",
 74    "Resources: Investigation Guide",
 75    "Rule Type: New Terms",
 76    "Tactic: Persistence",
 77    "Tactic: Collection",
 78    "Mitre Atlas: AML.T0053",
 79    "Mitre Atlas: AML.T0085",
 80]
 81timestamp_override = "event.ingested"
 82type = "new_terms"
 83
 84query = '''
 85data_stream.dataset: "openai_chatgpt_enterprise.codex_log" and
 86    event.action: "plugin_installed" and
 87    organization.id: * and
 88    user.email: * and
 89    openai_chatgpt_enterprise.codex_log.event_details.plugin_display_name: * and
 90    openai_chatgpt_enterprise.codex_log.event_details.plugin_name: *
 91'''
 92
 93
 94[[rule.threat]]
 95framework = "MITRE ATT&CK"
 96[[rule.threat.technique]]
 97id = "T1176"
 98name = "Software Extensions"
 99reference = "https://attack.mitre.org/techniques/T1176/"
100
101
102[rule.threat.tactic]
103id = "TA0003"
104name = "Persistence"
105reference = "https://attack.mitre.org/tactics/TA0003/"
106[[rule.threat]]
107framework = "MITRE ATT&CK"
108[[rule.threat.technique]]
109id = "T1213"
110name = "Data from Information Repositories"
111reference = "https://attack.mitre.org/techniques/T1213/"
112
113
114[rule.threat.tactic]
115id = "TA0009"
116name = "Collection"
117reference = "https://attack.mitre.org/tactics/TA0009/"
118[[rule.threat_mappings]]
119framework = "MITRE ATLAS"
120version = "2026.08"
121[[rule.threat_mappings.threat]]
122framework = "MITRE ATLAS"
123[[rule.threat_mappings.threat.technique]]
124id = "AML.T0053"
125name = "AI Agent Tool Invocation"
126reference = "https://atlas.mitre.org/techniques/AML.T0053/"
127
128
129[rule.threat_mappings.threat.tactic]
130id = "AML.TA0005"
131name = "Execution"
132reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
133[[rule.threat_mappings.threat]]
134framework = "MITRE ATLAS"
135[[rule.threat_mappings.threat.technique]]
136id = "AML.T0085"
137name = "Data from AI Services"
138reference = "https://atlas.mitre.org/techniques/AML.T0085/"
139
140
141[rule.threat_mappings.threat.tactic]
142id = "AML.TA0009"
143name = "Collection"
144reference = "https://atlas.mitre.org/tactics/AML.TA0009/"
145
146[rule.investigation_fields]
147field_names = [
148    "@timestamp",
149    "organization.id",
150    "user.id",
151    "user.email",
152    "openai_chatgpt_enterprise.codex_log.event_details.plugin_display_name",
153    "openai_chatgpt_enterprise.codex_log.event_details.plugin_name",
154    "openai_chatgpt_enterprise.codex_log.client_id",
155]
156
157[rule.new_terms]
158field = "new_terms_fields"
159value = [
160    "openai_chatgpt_enterprise.codex_log.event_details.plugin_display_name",
161    "openai_chatgpt_enterprise.codex_log.event_details.plugin_name",
162]
163[[rule.new_terms.history_window_start]]
164field = "history_window_start"
165value = "now-14d"