No LLM Jacking detected in API Management instances

Check ID: apim_threat_detection_llm_jacking
Provider: Azure
Service: apim
Severity: CRITICAL
Categories: gen-ai, logging, threat-detection
Resource type: microsoft.apimanagement/service

What this check verifies

API Management diagnostic logs in Log Analytics are analyzed for LLM-related operations. Requests are grouped by caller IP, the number of distinct monitored actions (e.g., ChatCompletions_Create, ImageGenerations_Create) within a configurable minutes window is measured, and that ratio is compared to a threshold to surface anomalous multi-action patterns.

Risk

Concentrated LLM activity from one IP indicates automation or leaked credentials.

Availability/cost: rapid token burn and quota exhaustion
Confidentiality: exposure of prompts/completions and model details
Integrity: abuse of deployment/model actions enabling unauthorized changes or mass content generation

Recommendation

Adopt defense in depth for LLM APIs:

Enforce least privilege; isolate management from inference
Prefer managed identities over keys; rotate secrets
Apply quotas, rate limiting, and IP allowlisting; use private access
Alert on anomalous action diversity; review logs

Tune threshold and minutes for your environment.

Remediation

Terraform
Native IaC
Dashboard steps

# Global APIM policy that blocks a specific IP
resource "azurerm_api_management_policy" "<example_resource_name>" {
  api_management_id = "<example_resource_id>"

  # Critical: Policy XML that blocks the offending IP by returning 403
  xml_content = <<XML
<policies>
  <inbound>
    <base />
    <choose>
      <!-- Critical: Block offending IP to stop LLM jacking -->
      <when condition="@(context.Request.IpAddress == \"<OFFENDING_IP>\")">
        <return-response>
          <set-status code="403" reason="Forbidden" />
        </return-response>
      </when>
    </choose>
  </inbound>
  <backend><base /></backend>
  <outbound><base /></outbound>
  <on-error><base /></on-error>
</policies>
XML
}

// Blocks a specific IP at the global (service) policy level for APIM
param apimName string
param blockedIp string

resource apim 'Microsoft.ApiManagement/service@2023-05-01-preview' existing = {
  name: apimName
}

resource apimPolicy 'Microsoft.ApiManagement/service/policies@2023-05-01-preview' = {
  parent: apim
  name: 'policy'
  properties: {
    value: '<policies><inbound><base /><choose><!-- Critical: Block offending IP to stop LLM jacking -->
      <when condition="@(context.Request.IpAddress == "${blockedIp}")">
        <return-response><set-status code="403" reason="Forbidden" /></return-response>
      </when>
    </choose></inbound><backend><base /></backend><outbound><base /></outbound><on-error><base /></on-error></policies>' // Critical: Policy XML that blocks the offending IP
    format: 'xml' // Critical: Apply policy as XML
  }
}

References

https://learn.microsoft.com/en-us/azure/api-management/monitor-api-management

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = apim_threat_detection_llm_jacking. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires