Techniques › T1698 › AN2293
AN2293 Analytic 2293
SaaS · attack.mitre.org · ATT&CK Enterprise v20.1
<p>An analyst observes an AI application retrieve or ingest lower-trust content containing instructions that attempt to redirect the application's behavior. Within the same agent execution context, the AI system subsequently attempts a tool invocation, resource access, or workflow transition outside the actions authorized for the original task or retrieved resource. The analyst correlates content provenance, instruction evidence, subsequent operation, and authorization context to identify potential promotion of untrusted content into operational authority.</p>
- Detects
- T1698 Indirect Prompt Injection
- Part of
- DET0942 Retrieved Instruction with Unauthorized Agent Action
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:bedrock | AgentTrace.knowledgeBaseLookupInput | DC0038 Application Log Content |
| AWS:bedrock | AgentTrace.actionGroupInvocationInput | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TrustedInstructionSources | Sources authorized to provide operational instructions to the AI application |
UntrustedContentSources | Retrieved resources and tool responses that must remain task data rather than operational authority |
AuthorizedAIWorkflows | Permitted task sequences and workflow transitions |
AICapabilityScopes | Authorized tools, resources, and operations for each agent or application role |
ApprovedContentDrivenActions | Actions retrieved content may legitimately influence |
RetrievalToActionWindow | Maximum interval between content ingestion and subsequent operation |
RequiredRetrievalCorrelation | Required session, trace, resource, or invocation identifiers linking the event sequence |
MinimumInstructionEvidence | Evidence required to distinguish an instruction attempt from ordinary retrieved data |
AuthorizedAdversarialTesting | Approved testing contexts and exceptions |