Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-CloudAI-AzureOpenAIKeyHijacking.
Upgrade to ProDetect Azure OpenAI API Key Theft and Reverse-Proxy Resale (LLMjacking) in Microsoft Sentinel
Adversaries who obtain a victim's Azure OpenAI resource API key — via a leaked key committed to a public repository, a phished Entra ID identity holding Cognitive Services Contributor/User, or a compromised CI/CD secret — can invoke the Chat Completions, Completions, and Embeddings endpoints directly using key-based authentication rather than an Entra ID bearer token. Because Azure OpenAI key auth is a static bearer credential with no MFA and no corresponding Entra ID sign-in event, the theft is invisible to identity-centric monitoring; the only telemetry is the Cognitive Services resource's own diagnostic logs and token-usage metrics. The dominant monetization pattern (documented by Sysdig, Permiso P0 Labs, and Lacework Labs as 'LLMjacking') is reselling proxied access to the stolen key on underground marketplaces or Discord/Telegram channels through an open-source reverse-proxy (e.g. oai-reverse-proxy) that fans a single stolen key out to many paying end users. This produces a distinctive fingerprint at the victim's Cognitive Services resource: a sharp, sustained increase in request volume and token consumption originating from a large and rapidly growing set of distinct caller IP addresses and user-agent strings, all authenticating with the same underlying key, well outside the resource's normal single-application usage baseline. Left undetected the victim absorbs the full compute cost of the resold access — frequently thousands of dollars per day for GPT-4-class deployments — and may exhaust provisioned-throughput quota needed for legitimate production traffic.
MITRE ATT&CK
- Tactic
- Impact
KQL Detection Query
// THREAT-CloudAI-AzureOpenAIKeyHijacking (T1496.004 Cloud Service Hijacking - LLMjacking via stolen Azure OpenAI key)
let Lookback = 24h;
let BucketWindow = 1h;
let RequestVolumeThreshold = 300;
let UniqueIPThreshold = 10;
// Branch 1: high request volume fanned out across an unusually large number of caller IPs on one Cognitive Services resource
let ProxyResaleFanout = AzureDiagnostics
| where TimeGenerated > ago(Lookback)
| where ResourceProvider == "MICROSOFT.COGNITIVESERVICES"
| where Category == "RequestResponse"
| where OperationName has_any ("ChatCompletions_Create", "Completions_Create", "Embeddings_Create", "ChatCompletions_Create_V2")
| summarize RequestCount = count(), UniqueCallerIPs = dcount(CallerIpAddress), UniqueUserAgents = dcount(UserAgent), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ResourceId, bin(TimeGenerated, BucketWindow)
| where RequestCount >= RequestVolumeThreshold and UniqueCallerIPs >= UniqueIPThreshold
| extend AttackPattern = "High-Volume Multi-Source Invocation — Likely Reverse-Proxy Key Resale", RiskLevel = "Critical";
// Branch 2: token-usage / cost metric spike on the same Cognitive Services resource (confirms financial impact, not just call volume)
let TokenUsageSpike = AzureMetrics
| where TimeGenerated > ago(Lookback)
| where ResourceProvider == "MICROSOFT.COGNITIVESERVICES"
| where MetricName in ("ProcessedPromptTokens", "GeneratedTokens", "TokenTransaction", "AzureOpenAIRequests")
| summarize TotalUsage = sum(Total), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ResourceId, MetricName, bin(TimeGenerated, BucketWindow)
| extend AttackPattern = strcat("Token/Request Metric Spike: ", MetricName), RiskLevel = "High";
// Branch 3: API key regenerated (containment/rotation event) followed by abuse resuming from a fresh set of IPs within hours — indicates the leaked key was already circulating and a second key was also compromised or reused
let KeyRegen = AzureActivity
| where TimeGenerated > ago(Lookback)
| where OperationNameValue =~ "MICROSOFT.COGNITIVESERVICES/ACCOUNTS/REGENERATEKEY/ACTION"
| where ActivityStatusValue == "Succeeded"
| project RegenTime = TimeGenerated, ResourceId, Caller;
let PostRegenAbuse = KeyRegen
| join kind=inner (ProxyResaleFanout) on ResourceId
| where TimeGenerated > RegenTime and TimeGenerated < RegenTime + 6h
| extend AttackPattern = "Abuse Pattern Resumed Within 6h of Key Regeneration — Possible Second Compromised Credential", RiskLevel = "Critical"
| project TimeGenerated, ResourceId, AttackPattern, RiskLevel, RequestCount, UniqueCallerIPs, UniqueUserAgents, FirstSeen, LastSeen;
ProxyResaleFanout
| project TimeGenerated, ResourceId, AttackPattern, RiskLevel, RequestCount, UniqueCallerIPs, UniqueUserAgents, FirstSeen, LastSeen
| union (TokenUsageSpike | project TimeGenerated, ResourceId, AttackPattern, RiskLevel, RequestCount = toint(TotalUsage), UniqueCallerIPs = 0, UniqueUserAgents = 0, FirstSeen, LastSeen)
| union PostRegenAbuse
| sort by RiskLevel desc, RequestCount descDetects LLMjacking against Azure OpenAI resources using Cognitive Services diagnostic logs (AzureDiagnostics, Category=RequestResponse) and usage metrics (AzureMetrics). The primary branch flags a single Cognitive Services resource receiving a high volume of Chat Completions/Completions/Embeddings calls from an unusually large and rapidly growing number of distinct caller IPs and user agents within a 1-hour window — the signature of a reverse-proxy fanning one stolen key out to many paying resale customers, rather than a single legitimate application. A secondary branch confirms financial impact via token-usage/cost metric spikes, and a tertiary branch flags abuse resuming within 6 hours of an API key regeneration, indicating a second compromised credential or incomplete containment.
Data Sources
Required Tables
False Positives & Tuning
- A legitimate multi-tenant SaaS application that itself proxies many end-user requests through a single shared Azure OpenAI deployment — baseline the expected caller IP range (typically the application's own egress IPs/CDN, not thousands of residential IPs) before tuning the unique-IP threshold
- Load testing or capacity/burn-in testing of a new Azure OpenAI deployment performed by the platform team ahead of a product launch
- A misconfigured client-side application that fans requests out through multiple regional gateways or a CDN, inflating unique caller IP counts without any credential compromise
- Batch data-processing jobs (e.g. bulk embeddings generation for a RAG pipeline) that intentionally parallelize across many worker nodes/containers, each with a different egress IP
- Migration of a workload to a serverless/autoscaling compute platform (e.g. Azure Functions, AKS with cluster autoscaler) that legitimately increases the diversity of caller IPs for the same application
Other platforms for THREAT-CloudAI-AzureOpenAIKeyHijacking
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate High-Volume Multi-Source Azure OpenAI Invocation
Expected signal: AzureDiagnostics RequestResponse entries for the test resource: OperationName=ChatCompletions_Create, 20 events within a short window, distinct UserAgent values per request (atomic-test-client-1 through 20).
- Test 2Simulate Token-Usage Cost Spike Metric
Expected signal: AzureMetrics entries for the test resource: MetricName=ProcessedPromptTokens and GeneratedTokens showing an aggregate increase over the 1-hour bucket well above the resource's idle baseline.
- Test 3Simulate Abuse Recurrence After Key Regeneration
Expected signal: AzureActivity entry: OperationNameValue=MICROSOFT.COGNITIVESERVICES/ACCOUNTS/REGENERATEKEY/ACTION, ActivityStatusValue=Succeeded, followed within minutes by AzureDiagnostics RequestResponse entries for the same ResourceId showing the second request burst.
References (8)
- https://attack.mitre.org/techniques/T1496/004/
- https://attack.mitre.org/tactics/TA0040/
- https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
- https://permiso.io/blog/exploring-llmjacking-attacks
- https://www.lacework.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack
- https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/monitor-openai
- https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/switching-endpoints
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1496.004/T1496.004.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-CloudAI-AzureOpenAIKeyHijacking — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month