Techniques › T1699 › AN2292
AN2292 Analytic 2292
SaaS · attack.mitre.org · ATT&CK Enterprise v20.1
<p>An analyst observes a user-originated instruction submitted to an AI application that attempts to override protected instructions or operational constraints. Within the same authenticated interaction, the AI system subsequently attempts a tool invocation, resource access, or workflow transition inconsistent with the authorized task or capability scope. The analyst correlates the originating instruction, subsequent operation, and authorization context to identify a potential successful instruction-boundary violation.</p>
- Detects
- T1699 Direct Prompt Injection
- Part of
- DET0941 Instruction Override with Unauthorized AI Activity
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| m365:unified | CopilotInteraction | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ProtectedInstructionBoundaries | Instructions and operational constraints that user-originated input cannot supersede |
AuthorizedAIWorkflows | Permitted task sequences and workflow transitions |
AICapabilityScopes | Authorized tools, operations, resources, and actions for each actor or agent role |
InstructionToActionWindow | Maximum interval between the submitted instruction and subsequent operation |
RequiredInteractionCorrelation | Required actor, session, interaction, or trace identifiers linking the observations |
MinimumOverrideEvidence | Evidence required to classify an instruction as an attempted authority override |
AuthorizedAdversarialTesting | Approved testing identities and execution contexts |