Copilot - Access From External IP Address
Detects when Copilot is accessed from an external IP address outside the corporate network. This is very dangerous if an attacker is using Copilot to enumerate data. This rule identifies potential account compromise…
Description
Detects when Copilot is accessed from an external IP address outside the corporate network. This is very dangerous if an attacker is using Copilot to enumerate data. This rule identifies potential account compromise scenarios where valid accounts are being used from unauthorized locations.
Detection logic
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- microsoftcopilot
- Log source service
- copilotactivity
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- f6a7b8c9-d0e1-42f3-a4b5-c6d7e8f9a0b1
- Tagged by the source as
- InitialAccess
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1