Techniques › T1685.007 › AN2294
AN2294 Analytic 2294
SaaS · attack.mitre.org · ATT&CK Enterprise v20.1
<p>An analyst observes an autonomous defensive system ingest an adversary-controlled artifact, message, or other lower-trust content during a security workflow. Following ingestion, the system unexpectedly terminates or truncates analysis, suppresses a detection, modifies a security decision, or attempts to disable a defensive capability contrary to the established workflow. The analyst correlates the ingested content, defensive task execution, and subsequent security-control state or disposition to identify potential adversarial manipulation of autonomous defenses.</p>
- Detects
- T1685.007 Impair Autonomous Defenses
- Part of
- DET0943 Adversarial Content Inducing Autonomous Defense Impairment
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ExpectedDefensiveWorkflows | Required analysis, detection, triage, or investigation steps for each defensive task |
ApprovedTerminationConditions | Authorized reasons for ending, truncating, or refusing analysis |
RequiredAnalysisOutputs | Evidence, findings, and completion artifacts expected before a defensive task can be considered complete |
AuthorizedAlertDispositions | Permitted alert state transitions and the conditions required for each |
ProtectedSecurityControls | Defensive configurations, policies, and capabilities that the autonomous agent cannot disable or modify without authorization |
ArtifactToDeviationWindow | Maximum interval between processing suspicious content and an anomalous defensive action |
RequiredTaskCorrelation | Task, artifact, trace, and operation identifiers necessary to correlate the event sequence |
ApprovedWorkflowExceptions | Legitimate maintenance, policy-driven exclusions, and authorized human interventions |