Techniques › T1700
T1700 AI-Enabled Exfiltration
exfiltration — Windows, SaaS · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1700
0
KEV CVEs mapped here
<p>Adversaries may utilize Direct Prompt Injection, Indirect Prompt Injection or other methods to instruct enterprise AI agents to exfiltrate data. When enterprise systems incorporate the use of AI assistants or other AI agents, adversaries may abuse these systems to weaponize sanctioned tools available to the agent.</p><p>As an AI agent processes queries or ingests data, an injected prompt can cause the agent to use its tool connections in unauthorized or unintended ways. When AI agents are induced to exfiltrate data, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration to Code Repository or Exfiltration Over Web Service.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 75.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v20.0
- DET0927 Detect AI-Enabled Exfiltration v1.0
AN2079 WindowsAn analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection to a destination outside $AuthorizedAIEndpoints$ from the same process lineage.Tunable:
AuthorizedAIDataScopeExpectedAIProcessTreeAuthorizedAIEndpointsEndpointExfilWindowAN2078 SaaSAn analyst observes an AI agent access $ProtectedDataScope$, invoke a tool/API using that information or a derived payload, and the destination service record a successful transfer to a recipient, repository, tenant, domain, or service outside $AuthorizedAIDataFlows$.Tunable:ProtectedDataScopeAuthorizedAgentActionsAuthorizedAIDataFlowsAuthorizedAIOutputDestinationsAIExfiltrationWindowAN2080 LinuxAn analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection from the same lineage to a destination outside $AuthorizedAIEndpoints$.Tunable:AuthorizedAIDataScopeExpectedAIProcessTreeAuthorizedAIEndpointsEndpointExfilWindow
Sigma rules · SigmaHQ c04ad420b4, tag attack.t1700
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.