Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Potential Azure OpenAI Model Theft

Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are unusual during model interactions.

ATT&CK coverage

This detection is not mapped to any ATT&CK technique.

What the source says

What fires this without an attack behind it

Authorized model training
Legitimate high volume data exchanges during scheduled updates

References

Tagged by the source as

Data Source: Azure Event HubsData Source: Azure OpenAIDomain: LLMMitre Atlas: T0044Resources: Investigation GuideUse Case: Model Theft

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.