Users Running Multiple Local AI Agents (SID-Based)
This rule identifies accounts (by SID) that have registered multiple local AI agent instances. It aggregates agent registration information over a 30-day period, summarizing the total count of agents and listing specific device names and IDs associated with each account to identify potential anomalous behavior, such as credential abuse or unauthorized mass deployment of local AI tools.
Microsoft Sentinel (KQL)
