LiteLLM Proxy Auth Using Default Master Key sk-1234
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Microsoft Sentinel (KQL)

