Tag
Microsoft 365 Copilot Multiple Vulnerabilities
2 rules 2 TTPsA remote, anonymous attacker can exploit multiple vulnerabilities in Microsoft 365 Copilot to execute arbitrary program code and disclose confidential information.
CVE-2026-42893: M365 Copilot Command Injection Vulnerability
1 rule 1 TTP 1 CVECVE-2026-42893 is a command injection vulnerability in M365 Copilot that allows an unauthorized attacker to perform tampering over a network.
M365 Copilot Impersonation Jailbreak Attempt Detection
2 rules 1 TTPThis detection identifies M365 Copilot impersonation and roleplay jailbreak attempts by analyzing exported eDiscovery prompt logs, searching for users manipulating the AI into adopting alternate personas or bypassing safety controls via roleplay keywords, categorizing specific impersonation types to identify persona injection attacks.
M365 Copilot Application Usage Pattern Anomalies
2 rules 1 TTPThis detection identifies anomalous M365 Copilot usage patterns indicative of potential account compromise or automated abuse by flagging users accessing Copilot from multiple locations, generating excessive daily activity, or utilizing multiple Copilot applications.
M365 Copilot Access from Non-Compliant Devices
2 rules 1 TTPDetects Microsoft 365 (M365) Copilot access from non-compliant or unmanaged devices, potentially indicating shadow IT, BYOD policy violations, or compromised endpoints accessing sensitive data.
Detection of M365 Copilot Jailbreak Attempts via Prompt Injection
2 rules 1 TTPThis detection identifies attempts to jailbreak M365 Copilot by using prompt injection techniques to bypass safety controls and manipulate system behavior, potentially violating acceptable use policies.