Abnormal LLM API spend/token spike indicating hijacked API key
Detects sustained spikes in AI/LLM API spend or token consumption for a given API key relative to its own dynamic rolling baseline, which may indicate a stolen/hijacked API key being resold or abused via gray-market proxy services (token jacking).
Microsoft Sentinel (KQL)
