Techniques › T1700 › AN2078
AN2078 Analytic 2078
SaaS · attack.mitre.org · ATT&CK Enterprise v20.0
<p>An analyst observes an AI agent access $ProtectedDataScope$, invoke a tool/API using that information or a derived payload, and the destination service record a successful transfer to a recipient, repository, tenant, domain, or service outside $AuthorizedAIDataFlows$.</p>
- Detects
- T1700 AI-Enabled Exfiltration
- Part of
- DET0927 Detect AI-Enabled Exfiltration
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| saas:audit | Actual send/share/upload/write operation | DC0038 Application Log Content |
| AWS:bedrock | AgentTrace.actionGroupInvocationInput | DC0038 Application Log Content |
| AWS:bedrock | AgentTrace.knowledgeBaseLookupInput | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ProtectedDataScope | protected information |
AuthorizedAgentActions | tools/functions legitimately available for workflow |
AuthorizedAIDataFlows | allowed source→tool→destination relationships |
AuthorizedAIOutputDestinations | permitted recipients/domains/tenants/repos/connectors |
AIExfiltrationWindow | normal access→transfer interval |