Billing Limit Removal or Usage Alert Disabling on AI Service Account
Detects operations that remove, disable, delete, or update billing limits, spending limits, usage alerts, spend notifications, billing thresholds, or cost alerts on AI service accounts, which may indicate an attacker attempting to remove financial guardrails to enable unrestricted abuse of stolen AI API credentials.
Microsoft Sentinel (KQL)
