M365 Copilot Information Extraction Jailbreak Attack

This rule detects attempts to bypass M365 Copilot's safeguards and extract sensitive or comprehensive information using various social engineering techniques. It specifically looks for keywords in the 'Subject_Title' field of exported eDiscovery prompt logs that indicate requests for classified, proprietary, or bulk data, or attempts to bypass privacy controls. The rule categorizes these attempts by extraction type and assigns severity levels, filtering out low-severity cases to highlight the most critical risks of AI manipulation for data exfiltration.