Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-CloudAI-AzureOpenAIKeyHijacking.
Upgrade to ProDetect Azure OpenAI API Key Theft and Reverse-Proxy Resale (LLMjacking) in Splunk
Adversaries who obtain a victim's Azure OpenAI resource API key — via a leaked key committed to a public repository, a phished Entra ID identity holding Cognitive Services Contributor/User, or a compromised CI/CD secret — can invoke the Chat Completions, Completions, and Embeddings endpoints directly using key-based authentication rather than an Entra ID bearer token. Because Azure OpenAI key auth is a static bearer credential with no MFA and no corresponding Entra ID sign-in event, the theft is invisible to identity-centric monitoring; the only telemetry is the Cognitive Services resource's own diagnostic logs and token-usage metrics. The dominant monetization pattern (documented by Sysdig, Permiso P0 Labs, and Lacework Labs as 'LLMjacking') is reselling proxied access to the stolen key on underground marketplaces or Discord/Telegram channels through an open-source reverse-proxy (e.g. oai-reverse-proxy) that fans a single stolen key out to many paying end users. This produces a distinctive fingerprint at the victim's Cognitive Services resource: a sharp, sustained increase in request volume and token consumption originating from a large and rapidly growing set of distinct caller IP addresses and user-agent strings, all authenticating with the same underlying key, well outside the resource's normal single-application usage baseline. Left undetected the victim absorbs the full compute cost of the resold access — frequently thousands of dollars per day for GPT-4-class deployments — and may exhaust provisioned-throughput quota needed for legitimate production traffic.
MITRE ATT&CK
- Tactic
- Impact
SPL Detection Query
index=azure sourcetype="azure:diagnostics" resourceProvider="MICROSOFT.COGNITIVESERVICES" category="RequestResponse"
| search operationName IN ("ChatCompletions_Create","Completions_Create","Embeddings_Create","ChatCompletions_Create_V2")
| bin _time span=1h
| stats count as RequestCount, dc(callerIpAddress) as UniqueCallerIPs, dc(userAgent) as UniqueUserAgents, min(_time) as FirstSeen, max(_time) as LastSeen by resourceId, _time
| where RequestCount >= 300 AND UniqueCallerIPs >= 10
| eval AttackPattern="High-Volume Multi-Source Invocation - Likely Reverse-Proxy Key Resale", RiskLevel="Critical"
| append
[ search index=azure sourcetype="azure:metrics" resourceProvider="MICROSOFT.COGNITIVESERVICES" metricName IN ("ProcessedPromptTokens","GeneratedTokens","TokenTransaction","AzureOpenAIRequests")
| bin _time span=1h
| stats sum(total) as RequestCount, min(_time) as FirstSeen, max(_time) as LastSeen by resourceId, metricName, _time
| eval AttackPattern="Token/Request Metric Spike: ".metricName, RiskLevel="High" ]
| append
[ search index=azure sourcetype="azure:activity" operationNameValue="MICROSOFT.COGNITIVESERVICES/ACCOUNTS/REGENERATEKEY/ACTION" activityStatusValue="Succeeded"
| rename _time as RegenTime
| join resourceId
[ search index=azure sourcetype="azure:diagnostics" resourceProvider="MICROSOFT.COGNITIVESERVICES" category="RequestResponse"
| bin _time span=1h
| stats count as RequestCount, dc(callerIpAddress) as UniqueCallerIPs by resourceId, _time ]
| where _time > RegenTime AND _time < RegenTime + 21600
| eval AttackPattern="Abuse Pattern Resumed Within 6h of Key Regeneration - Possible Second Compromised Credential", RiskLevel="Critical" ]
| sort - RiskLevel, - RequestCountSPL equivalent spanning Azure Cognitive Services diagnostic logs and metrics ingested via the Splunk Add-on for Microsoft Cloud Services. Flags a resource receiving a high volume of Azure OpenAI inference calls from an unusually large set of distinct caller IPs/user agents in a 1-hour bucket (reverse-proxy resale signature), correlates with token/request metric spikes for cost confirmation, and flags abuse recurrence within 6 hours of a key regeneration event.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate multi-tenant SaaS application proxying many end-user requests through one shared deployment
- Load/capacity testing of a new Azure OpenAI deployment ahead of launch
- Client-side application fanning requests across multiple regional gateways or a CDN
- Batch/RAG embeddings pipelines parallelized across many autoscaled workers
- Migration to serverless/autoscaling compute that legitimately increases caller IP diversity
Other platforms for THREAT-CloudAI-AzureOpenAIKeyHijacking
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate High-Volume Multi-Source Azure OpenAI Invocation
Expected signal: AzureDiagnostics RequestResponse entries for the test resource: OperationName=ChatCompletions_Create, 20 events within a short window, distinct UserAgent values per request (atomic-test-client-1 through 20).
- Test 2Simulate Token-Usage Cost Spike Metric
Expected signal: AzureMetrics entries for the test resource: MetricName=ProcessedPromptTokens and GeneratedTokens showing an aggregate increase over the 1-hour bucket well above the resource's idle baseline.
- Test 3Simulate Abuse Recurrence After Key Regeneration
Expected signal: AzureActivity entry: OperationNameValue=MICROSOFT.COGNITIVESERVICES/ACCOUNTS/REGENERATEKEY/ACTION, ActivityStatusValue=Succeeded, followed within minutes by AzureDiagnostics RequestResponse entries for the same ResourceId showing the second request burst.
References (8)
- https://attack.mitre.org/techniques/T1496/004/
- https://attack.mitre.org/tactics/TA0040/
- https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
- https://permiso.io/blog/exploring-llmjacking-attacks
- https://www.lacework.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack
- https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/monitor-openai
- https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/switching-endpoints
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1496.004/T1496.004.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-CloudAI-AzureOpenAIKeyHijacking — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month