Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects deletion of an Azure AI Foundry Responsible AI (RAI) content-filter policy.

Strategy

This rule monitors Azure Activity Log events where @evt.name is MICROSOFT.COGNITIVESERVICES/ACCOUNTS/RAIPOLICIES/DELETE. RAI policies define the content-filtering guardrails (blocked categories, prompt injection protection) applied to an Azure AI Foundry / Cognitive Services model deployment. Attackers often disable or delete guardrail policies during LLMJacking to gain access to a wider array of inference options.

Triage & Response

• Examine the resourceId and properties.entity fields on the triggering event to identify which Cognitive Services account and RAI policy {{@usr.id}} deleted.
• Verify if {{@usr.id}} has a legitimate business reason to delete this RAI policy, such as a documented decommissioning or policy-consolidation request.
• Determine which model deployments were using the deleted RAI policy, and whether they are experiencing any suspicious activity associated with LLMJacking.
• Determine whether replacement RAI policies used by deployments in the Azure AI Foundry account are missing important security controls such as prompt injection protection.