Threat intelligence / CTI
Threat intelligence
Native STIX cyber-threat intelligence — exploited vulnerabilities, attack techniques, malware, campaigns, and threat actors — correlated against the canonical store. A separate taxonomy covers threats to AI and machine-learning systems.
SourcesCISA KEV · enterprise techniques · AI system threatsFreshnessRelease-trackedMethodSTIX 2.1 normalization
Vulnerabilities1665
Techniques1651
Malware734
Groups & actors191
Remediation order
Exploited vulnerabilities by due date
No exploited vulnerabilities with a due date in the current picture.
Evidence stream
Threat intelligence objects
01dnf-model-countingToolNationalSecurityAgency/dnf-model-counting02FoundationFoundation is a repository of formal cryptographic specificationsToolNationalSecurityAgency/Foundation03openflameToolNationalSecurityAgency/openflame04ghidra-lisaToolNationalSecurityAgency/ghidra-lisa05seabeeHardens eBPF tools against privileged attackers via policy-based access controlsToolNationalSecurityAgency/seabee06datawave-accumulo-pluginsA reusable set of plugins implementing Accumulo's SPI for use with DataWaveToolNationalSecurityAgency/datawave-accumulo-plugins07datawave-map-serviceToolNationalSecurityAgency/datawave-map-service08datawave-file-provider-serviceToolNationalSecurityAgency/datawave-file-provider-service09.githubToolNationalSecurityAgency/.github10ghidra-volatilityToolNationalSecurityAgency/ghidra-volatility11ghidra-fridaToolNationalSecurityAgency/ghidra-frida12TraceAnalysisToolNationalSecurityAgency/TraceAnalysis13datawave-helm-chartsToolNationalSecurityAgency/datawave-helm-charts14datawave-stack-docker-imagesToolNationalSecurityAgency/datawave-stack-docker-images15rank-based-linkageToolNationalSecurityAgency/rank-based-linkage16datawave-tablesToolNationalSecurityAgency/datawave-tables17ghidra-extensionsToolNationalSecurityAgency/ghidra-extensions18datawave-spring-boot-starter-cached-resultsToolNationalSecurityAgency/datawave-spring-boot-starter-cached-results19datawave-mapreduce-query-serviceToolNationalSecurityAgency/datawave-mapreduce-query-service20datawave-ingest-servicesToolNationalSecurityAgency/datawave-ingest-services21datawave-modification-serviceToolNationalSecurityAgency/datawave-modification-service22datawave-query-storage-serviceToolNationalSecurityAgency/datawave-query-storage-service23datawave-query-executor-serviceToolNationalSecurityAgency/datawave-query-executor-service24datawave-query-serviceToolNationalSecurityAgency/datawave-query-service25datawave-spring-boot-starter-metadataToolNationalSecurityAgency/datawave-spring-boot-starter-metadata26datawave-spring-boot-starter-query-metricToolNationalSecurityAgency/datawave-spring-boot-starter-query-metric27datawave-spring-boot-starter-queryToolNationalSecurityAgency/datawave-spring-boot-starter-query28datawave-query-metric-serviceToolNationalSecurityAgency/datawave-query-metric-service29call-stack-profilerSkillTreeToolNationalSecurityAgency/call-stack-profiler30skills-stress-testSkillTreeToolNationalSecurityAgency/skills-stress-test31skills-client-examplesSkillTree skills-client-examplesToolNationalSecurityAgency/skills-client-examples32skills-clientSkillTree client libraries facilitate the rapid integration of a gamified tool training approach in conjunction with skills-service.ToolNationalSecurityAgency/skills-client33skills-docsSkillTree documentation, covering client integration, dashboard administration and deployment, and contribution guidelines.ToolNationalSecurityAgency/skills-docs34skills-serviceSkillTree is a micro-learning gamification platform supporting the rapid integration of a gamified tool training approach into new and existing applications.ToolNationalSecurityAgency/skills-service35XORSATFilterA library for building efficient set-membership filters and dictionaries based on the Satisfiability problem.ToolNationalSecurityAgency/XORSATFilter36datawave-type-utilsToolNationalSecurityAgency/datawave-type-utils37datawave-spring-boot-starter-cacheToolNationalSecurityAgency/datawave-spring-boot-starter-cache38datawave-spring-boot-starter-auditToolNationalSecurityAgency/datawave-spring-boot-starter-audit39datawave-spring-boot-starterToolNationalSecurityAgency/datawave-spring-boot-starter40datawave-service-parentToolNationalSecurityAgency/datawave-service-parent41datawave-microservices-rootToolNationalSecurityAgency/datawave-microservices-root42datawave-parentToolNationalSecurityAgency/datawave-parent43datawave-metrics-reporterToolNationalSecurityAgency/datawave-metrics-reporter44datawave-metadata-utilsToolNationalSecurityAgency/datawave-metadata-utils45datawave-hazelcast-serviceToolNationalSecurityAgency/datawave-hazelcast-service46datawave-utilsToolNationalSecurityAgency/datawave-utils47datawave-dictionary-serviceThe Dictionary service provides access to the data dictionary and edge dictionary. These services provide metadata about fields that are stored in Accumulo.ToolNationalSecurityAgency/datawave-dictionary-service48datawave-config-serviceToolNationalSecurityAgency/datawave-config-service49datawave-common-utilsToolNationalSecurityAgency/datawave-common-utils50datawave-base-rest-responsesToolNationalSecurityAgency/datawave-base-rest-responses51datawave-authorization-serviceToolNationalSecurityAgency/datawave-authorization-service52datawave-audit-serviceToolNationalSecurityAgency/datawave-audit-service53datawave-accumulo-utilsToolNationalSecurityAgency/datawave-accumulo-utils54datawave-accumulo-serviceToolNationalSecurityAgency/datawave-accumulo-service55datawave-in-memory-accumuloToolNationalSecurityAgency/datawave-in-memory-accumulo56ghidra-dataSupporting Data Archives for GhidraToolNationalSecurityAgency/ghidra-data57ghidraGhidra is a software reverse engineering (SRE) frameworkToolNationalSecurityAgency/ghidra58enigma-simulatorAn educational demonstration of breaking the Enigma machineToolNationalSecurityAgency/enigma-simulator59nationalsecurityagency.github.ioSite for NSA's Open Source project listingToolNationalSecurityAgency/nationalsecurityagency.github.io60emissaryDistributed P2P Data-driven Workflow FrameworkToolNationalSecurityAgency/emissary61datawave-muchosThis project leverages Ansible to automate DataWave deployments on your clusterToolNationalSecurityAgency/datawave-muchos62fractalrabbitSimulate realistic trajectory data seen through sporadic reportingToolNationalSecurityAgency/fractalrabbit63datawaveDataWave is an ingest/query framework that leverages Apache Accumulo to provide fast, secure data access.ToolNationalSecurityAgency/datawave64qonduitA WebSocket library for use with Apache AccumuloToolNationalSecurityAgency/qonduit65lemongrenadeData-driven automation platformToolNationalSecurityAgency/lemongrenade66lemongraphLog-based transactional graph engineToolNationalSecurityAgency/lemongraph67timelyAccumulo backed time series databaseToolNationalSecurityAgency/timely68DEPRECATED: XML Parser AttackThis attack pattern has been deprecated as it a generalization of CAPEC-230: XML Nested Payloads and CAPEC-231: XML Oversized Payloads. Please refer to these CAPECs going forward.TechniqueCAPEC-9969PhishingPhishing is a social engineering technique where an attacker masquerades as a legitimate entity with which the victim might do business in order to prompt the user to reveal some confidential information (very frequently authentication cred…TechniqueCAPEC-9870CryptanalysisCryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction). Sometimes the weakness is not in the cryptographic algor…TechniqueCAPEC-9771Block Access to LibrariesAn application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries. It is possible that the application does n…TechniqueCAPEC-9672WSDL ScanningThis attack targets the WSDL interface made available by a web service. The attacker may scan the WSDL interface to reveal sensitive information about invocation patterns, underlying technology implementations and associated vulnerabilities…TechniqueCAPEC-9573Adversary in the Middle (AiTM){"p":"An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channe…TechniqueCAPEC-9474Log Injection-Tampering-ForgingThis attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing them to mislead a log audit, cover traces of attack, or perform other malicious actions. The t…TechniqueCAPEC-9375Forced Integer OverflowThis attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out…TechniqueCAPEC-9276DEPRECATED: XSS in IMG TagsThis attack pattern has been deprecated as it is contained in the existing attack pattern "CAPEC-18 : XSS Targeting Non-Script Elements". Please refer to this other CAPEC going forward.TechniqueCAPEC-9177Reflection Attack in Authentication ProtocolAn adversary can abuse an authentication protocol susceptible to reflection attack in order to defeat it. Doing so allows the adversary illegitimate access to the target system, without possessing the requisite credentials. Reflection attac…TechniqueCAPEC-9078Buffer Overflow in Local Command-Line UtilitiesThis attack targets command-line utilities available in a number of shells. An adversary can leverage a vulnerability found in a command-line utility to escalate privilege to root.TechniqueCAPEC-979PharmingA pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform. An attacker can impersonate these supposedly trusted sites and have the vi…TechniqueCAPEC-8980OS Command InjectionIn this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection i…TechniqueCAPEC-8881Forceful BrowsingAn attacker employs forceful browsing (direct URL entry) to access portions of a website that are otherwise unreachable. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. F…TechniqueCAPEC-8782XSS Through HTTP HeadersAn adversary exploits web applications that generate web content, such as links in a HTML page, based on unvalidated or improperly validated data submitted by other actors. XSS in HTTP Headers attacks target the HTTP headers which are hidde…TechniqueCAPEC-8683AJAX FootprintingThis attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attac…TechniqueCAPEC-8584XQuery InjectionThis attack utilizes XQuery to probe and attack server systems; in a similar manner that SQL Injection allows an attacker to exploit SQL calls to RDBMS, XQuery Injection uses improperly validated data that is passed to XQuery commands to tr…TechniqueCAPEC-8485XPath InjectionAn attacker can craft special user-controllable input consisting of XPath expressions to inject the XML database and bypass authentication or glean information that they normally would not be able to. XPath Injection enables an attacker to …TechniqueCAPEC-8386DEPRECATED: Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))This attack pattern has been deprecated as it a generalization of CAPEC-230: XML Nested Payloads, CAPEC-231: XML Oversized Payloads, and CAPEC-147: XML Ping of Death. Please refer to these CAPECs going forward.TechniqueCAPEC-8287Web Server Logs TamperingWeb Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may ta…TechniqueCAPEC-8188Using UTF-8 Encoding to Bypass Validation LogicThis attack is a specific variation on leveraging alternate encodings to bypass validation logic. This attack leverages the possibility to encode potentially harmful input in UTF-8 and submit it to applications not expecting or effective at…TechniqueCAPEC-8089Buffer Overflow in an API CallThis attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An adversary who has knowledge of known vulnerable libraries or shared code can easily target software that makes use of these libraries. …TechniqueCAPEC-890Using Slashes in Alternate EncodingThis attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, suc…TechniqueCAPEC-7991Using Escaped Slashes in Alternate EncodingThis attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick…TechniqueCAPEC-7892Manipulating User-Controlled VariablesThis attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitizatio…TechniqueCAPEC-7793Manipulating Web Input to File System CallsAn attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be…TechniqueCAPEC-7694Manipulating Writeable Configuration FilesGenerally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the appli…TechniqueCAPEC-7595Manipulating State{"p":["The adversary modifies state information maintained by the target software or causes a state transition in hardware. If successful, the target will use this tainted state and execute in an unintended manner.","State management is an …TechniqueCAPEC-7496User-Controlled FilenameAn attack of this type involves an adversary inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable c…TechniqueCAPEC-7397URL EncodingThis attack targets the encoding of the URL. An adversary can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL.TechniqueCAPEC-7298Using Unicode Encoding to Bypass Validation LogicAn attacker may provide a Unicode string to a system component that is not Unicode aware and use that to circumvent the filter or cause the classifying mechanism to fail to properly understanding the request. That may allow the attacker to …TechniqueCAPEC-7199Exploiting Incorrect Chaining or Granularity of Hardware Debug Components{"p":"An adversary exploits incorrect chaining or granularity of hardware debug components in order to gain unauthorized access to debug functionality on a chip. This happens when authorization is not checked on a per function basis and is …TechniqueCAPEC-702100Browser in the Middle (BiTM)An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote deskto…TechniqueCAPEC-701101Network Boundary BridgingAn adversary which has gained elevated access to network boundary devices may use these devices to create a channel to bridge trusted and untrusted networks. Boundary devices do not necessarily have to be on the network’s edge, but rather m…TechniqueCAPEC-700102Try Common or Default Usernames and PasswordsAn adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials,…TechniqueCAPEC-70103Blind SQL InjectionBlind SQL Injection results from an insufficient mitigation for SQL Injection. Although suppressing database error messages are considered best practice, the suppression alone is not sufficient to prevent SQL Injection. Blind SQL Injection …TechniqueCAPEC-7104Eavesdropping on a MonitorAn Adversary can eavesdrop on the content of an external monitor through the air without modifying any cable or installing software, just capturing this signal emitted by the cable or video port, with this the attacker will be able to impac…TechniqueCAPEC-699105Install Malicious Extension{"p":"An adversary directly installs or tricks a user into installing a malicious extension into existing trusted software, with the goal of achieving a variety of negative technical impacts."}TechniqueCAPEC-698106DHCP Spoofing{"p":"An adversary masquerades as a legitimate Dynamic Host Configuration Protocol (DHCP) server by spoofing DHCP traffic, with the goal of redirecting network traffic or denying service to DHCP."}TechniqueCAPEC-697107Load Value InjectionAn adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution in which a faulting or assisted load instruction transiently forwards adversary-controlled data from microarchitectural buffers. By indu…TechniqueCAPEC-696108Repo Jacking{"p":"An adversary takes advantage of the redirect property of directly linked Version Control System (VCS) repositories to trick users into incorporating malicious code into their applications."}TechniqueCAPEC-695109System Location Discovery{"p":["An adversary collects information about the target system in an attempt to identify the system's geographical location.","Information gathered could include keyboard layout, system language, and timezone. This information may benefit…TechniqueCAPEC-694110StarJacking{"p":"An adversary spoofs software popularity metadata to deceive users into believing that a maliciously provided package is widely used and originates from a trusted source."}TechniqueCAPEC-693111Spoof Version Control System Commit Metadata{"p":"An adversary spoofs metadata pertaining to a Version Control System (VCS) (e.g., Git) repository's commits to deceive users into believing that the maliciously provided software is frequently maintained and originates from a trusted s…TechniqueCAPEC-692112Spoof Open-Source Software Metadata{"p":"An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted."}TechniqueCAPEC-691113Metadata Spoofing{"p":"An adversary alters the metadata of a resource (e.g., file, directory, repository, etc.) to present a malicious resource as legitimate/credible."}TechniqueCAPEC-690114Target Programs with Elevated PrivilegesThis attack targets programs running with elevated privileges. The adversary tries to leverage a vulnerability in the running program and get arbitrary code to execute with elevated privileges.TechniqueCAPEC-69115Exploitation of Firmware or ROM Code with Unpatchable VulnerabilitiesAn adversary may exploit vulnerable code (i.e., firmware or ROM) that is unpatchable. Unpatchable devices exist due to manufacturers intentionally or inadvertently designing devices incapable of updating their software. Additionally, with u…TechniqueCAPEC-682116Exploitation of Improperly Controlled Hardware Security Identifiers{"p":"An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action."}TechniqueCAPEC-681117Exploitation of Improperly Controlled Registers{"p":"An adversary exploits missing or incorrectly configured access control within registers to read/write data that is not meant to be obtained or modified by a user."}TechniqueCAPEC-680118Subvert Code-signing FacilitiesMany languages use code signing facilities to vouch for code's identity and to thus tie code to its assigned privileges within an environment. Subverting this mechanism can be instrumental in an attacker escalating privilege. Any means of s…TechniqueCAPEC-68119Exploitation of Improperly Configured or Implemented Memory Protections{"p":"An adversary takes advantage of missing or incorrectly configured access control within memory to read/write data or inject malicious code into said memory."}TechniqueCAPEC-679120System Build Data Maliciously Altered{"p":"During the system build process, the system is deliberately misconfigured by the alteration of the build data. Access to system configuration data files and build processes is susceptible to deliberate misconfiguration of the system."…TechniqueCAPEC-678121Server Motherboard Compromise{"p":"Malware is inserted in a server motherboard (e.g., in the flash memory) in order to alter server functionality from that intended. The development environment or hardware/software support activity environment is susceptible to an adve…TechniqueCAPEC-677122NoSQL Injection{"p":"An adversary targets software that constructs NoSQL statements based on user input or with parameters vulnerable to operator replacement in order to achieve a variety of technical impacts such as escalating privileges, bypassing authe…TechniqueCAPEC-676123Retrieve Data from Decommissioned Devices{"p":"An adversary obtains decommissioned, recycled, or discarded systems and devices that can include an organization’s intellectual property, employee data, and other types of controlled information. Systems and devices that have reached …TechniqueCAPEC-675124Design for FPGA Maliciously Altered{"p":"An adversary alters the functionality of a field-programmable gate array (FPGA) by causing an FPGA configuration memory chip reload in order to introduce a malicious function that could result in the FPGA performing or enabling malici…TechniqueCAPEC-674125Developer Signing Maliciously Altered Software{"p":["Software produced by a reputable developer is clandestinely infected with malicious code and then digitally signed by the unsuspecting developer, where the software has been altered via a compromised software development or build pro…TechniqueCAPEC-673126Malicious Code Implanted During Chip Programming{"p":"During the programming step of chip manufacture, an adversary with access and necessary technical skills maliciously alters a chip’s intended program logic to produce an effect intended by the adversary when the fully manufactured chi…TechniqueCAPEC-672127Requirements for ASIC Functionality Maliciously AlteredAn adversary with access to functional requirements for an application specific integrated circuit (ASIC), a chip designed/customized for a singular particular use, maliciously alters requirements derived from originating capability needs. …TechniqueCAPEC-671128Software Development Tools Maliciously AlteredAn adversary with the ability to alter tools used in a development environment causes software to be developed with maliciously modified tools. Such tools include requirements management and database tools, software design tools, configurat…TechniqueCAPEC-670129String Format Overflow in syslog()This attack targets applications and software that uses the syslog() function insecurely. If an application does not explicitely use a format string parameter in a call to syslog(), user input can be placed in the format string parameter le…TechniqueCAPEC-67130Alteration of a Software Update{"p":"An adversary with access to an organization’s software update infrastructure inserts malware into the content of an outgoing update to fielded systems where a wide range of malicious effects are possible. With the same level of access…TechniqueCAPEC-669131Key Negotiation of Bluetooth Attack (KNOB)An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the t…TechniqueCAPEC-668132Bluetooth Impersonation AttackS (BIAS)An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth…TechniqueCAPEC-667133BlueSmackingAn adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.TechniqueCAPEC-666134Exploitation of Thunderbolt Protection Flaws{"p":"An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verificatio…TechniqueCAPEC-665135Server Side Request Forgery{"p":"An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in th…TechniqueCAPEC-664136Exploitation of Transient Instruction ExecutionAn adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution to expose sensitive data and bypass/subvert access control over restricted resources. Typically, the adversary conducts a covert channel…TechniqueCAPEC-663137Adversary in the Browser (AiTB){"p":"An adversary exploits security vulnerabilities or inherent functionalities of a web browser, in order to manipulate traffic between two endpoints."}TechniqueCAPEC-662138Root/Jailbreak Detection Evasion via DebuggingAn adversary inserts a debugger into the program entry point of a mobile application to modify the application binary, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gai…TechniqueCAPEC-661139Root/Jailbreak Detection Evasion via HookingAn adversary forces a non-restricted mobile application to load arbitrary code or code files, via Hooking, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administra…TechniqueCAPEC-660140SQL InjectionThis attack exploits target software that constructs SQL statements based on user input. An attacker crafts input strings so that when the target software constructs SQL statements based on the input, the resulting SQL statement performs ac…TechniqueCAPEC-66141Malicious Automated Software Update via SpoofingAn attackers uses identify or content spoofing to trick a client into performing an automated software update from a malicious source. A malicious automated software update that leverages spoofing can include content or identity spoofing as…TechniqueCAPEC-657142Voice PhishingAn adversary targets users with a phishing attack for the purpose of soliciting account passwords or sensitive information from the user. Voice Phishing is a variation of the Phishing social engineering technique where the attack is initiat…TechniqueCAPEC-656143Avoid Security Tool Identification by Adding Data{"p":["An adversary adds data to a file to increase the file size beyond what security tools are capable of handling in an attempt to mask their actions.","In addition to this, adding data to a file also changes the file's hash, frustrating…TechniqueCAPEC-655144Credential Prompt ImpersonationAn adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.TechniqueCAPEC-654145Use of Known Operating System CredentialsAn adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or…TechniqueCAPEC-653146Use of Known Kerberos CredentialsAn adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or serv…TechniqueCAPEC-652147EavesdroppingAn adversary intercepts a form of communication (e.g. text, audio, video) by way of software (e.g., microphone and audio recording application), hardware (e.g., recording equipment), or physical means (e.g., physical proximity). The goal of…TechniqueCAPEC-651148Upload a Web Shell to a Web ServerBy exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web serve…TechniqueCAPEC-650149Sniff Application CodeAn adversary passively sniffs network communications and captures application code bound for an authorized client. Once obtained, they can use it as-is, or through reverse-engineering glean sensitive information or exploit the trust relatio…TechniqueCAPEC-65150Adding a Space to a File ExtensionAn adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notic…TechniqueCAPEC-649151Collect Data from Screen CaptureAn adversary gathers sensitive information by exploiting the system's screen capture functionality. Through screenshots, the adversary aims to see what happens on the screen over the course of an operation. The adversary can leverage inform…TechniqueCAPEC-648152Collect Data from RegistriesAn adversary exploits a weakness in authorization to gather system-specific data and sensitive information within a registry (e.g., Windows Registry, Mac plist). These contain information about the system configuration, software, operating …TechniqueCAPEC-647153Peripheral FootprintingAdversaries may attempt to obtain information about attached peripheral devices and components connected to a computer system. Examples may include discovering the presence of iOS devices by searching for backups, analyzing the Windows regi…TechniqueCAPEC-646154Use of Captured Tickets (Pass The Ticket)An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to servic…TechniqueCAPEC-645155Use of Captured Hashes (Pass The Hash)An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.TechniqueCAPEC-644156Identify Shared Files/Directories on SystemAn adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may fur…TechniqueCAPEC-643157Replace BinariesAdversaries know that certain binaries will be regularly executed as part of normal processing. If these binaries are not protected with the appropriate file system permissions, it could be possible to replace them with malware. This malwar…TechniqueCAPEC-642158DLL Side-LoadingAn adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location …TechniqueCAPEC-641159Inclusion of Code in Existing ProcessThe adversary takes advantage of a bug in an application failing to verify the integrity of the running process to execute arbitrary code in the address space of a separate live process. The adversary could use running code in the context o…TechniqueCAPEC-640160Using Slashes and URL Encoding Combined to Bypass Validation LogicThis attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special charact…TechniqueCAPEC-64161Probe System FilesAn adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for s…TechniqueCAPEC-639162Altered Component FirmwareAn adversary exploits systems features and/or improperly protected firmware of hardware components, such as Hard Disk Drives (HDD), with the goal of executing malicious code from within the component's Master Boot Record (MBR). Conducting t…TechniqueCAPEC-638163Collect Data from ClipboardThe adversary exploits an application that allows for the copying of sensitive data or information by collecting information copied to the clipboard. Data copied to the clipboard can be accessed by other applications, such as malware built …TechniqueCAPEC-637164Hiding Malicious Data or Code within FilesFiles on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are …TechniqueCAPEC-636165Alternative Execution Due to Deceptive FilenamesThe extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a d…TechniqueCAPEC-635166Probe Audio and Video PeripheralsThe adversary exploits the target system's audio and video functionalities through malware or scheduled tasks. The goal is to capture sensitive information about the target for financial, personal, political, or other gains which is accompl…TechniqueCAPEC-634167Token ImpersonationAn adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to…TechniqueCAPEC-633168Homograph Attack via HomoglyphsAn adversary registers a domain name containing a homoglyph, leading the registered domain to appear the same as a trusted domain. A homograph attack leverages the fact that different characters among various character sets look the same to…TechniqueCAPEC-632169SoundSquattingAn adversary registers a domain name that sounds the same as a trusted domain, but has a different spelling. A SoundSquatting attack takes advantage of a user's confusion of the two words to direct Internet traffic to adversary-controlled d…TechniqueCAPEC-631170TypoSquattingAn adversary registers a domain name with at least one character different than a trusted domain. A TypoSquatting attack takes advantage of instances where a user mistypes a URL (e.g. www.goggle.com) or not does visually verify a URL before…TechniqueCAPEC-630171Cross-Site Scripting (XSS)An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type …TechniqueCAPEC-63172DEPRECATED: Unauthorized Use of Device ResourcesThis attack pattern has been deprecated.TechniqueCAPEC-629173Carry-Off GPS AttackA common form of a GPS spoofing attack, commonly termed a carry-off attack begins with an adversary broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gra…TechniqueCAPEC-628174Counterfeit GPS SignalsAn adversary attempts to deceive a GPS receiver by broadcasting counterfeit GPS signals, structured to resemble a set of normal GPS signals. These spoofed signals may be structured in such a way as to cause the receiver to estimate its posi…TechniqueCAPEC-627175Smudge AttackAttacks that reveal the password/passcode pattern on a touchscreen device by detecting oil smudges left behind by the user’s fingers.TechniqueCAPEC-626176Mobile Device Fault InjectionFault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptogr…TechniqueCAPEC-625177Hardware Fault InjectionThe adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient tempera…TechniqueCAPEC-624178Compromising Emanations AttackCompromising Emanations (CE) are defined as unintentional signals which an attacker may intercept and analyze to disclose the information processed by the targeted equipment. Commercial mobile devices and retransmission devices have display…TechniqueCAPEC-623179Electromagnetic Side-Channel AttackIn this attack scenario, the attacker passively monitors electromagnetic emanations that are produced by the targeted electronic device as an unintentional side-effect of its processing. From these emanations, the attacker derives informati…TechniqueCAPEC-622180Analysis of Packet Timing and SizesAn attacker may intercept and log encrypted transmissions for the purpose of analyzing metadata such as packet timing and sizes. Although the actual data may be encrypted, this metadata may reveal valuable information to an attacker. Note t…TechniqueCAPEC-621181Drop Encryption LevelAn attacker forces the encryption level to be lowered, thus enabling a successful attack against the encrypted data.TechniqueCAPEC-620182Cross Site Request ForgeryAn attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If …TechniqueCAPEC-62183Signal Strength TrackingIn this attack scenario, the attacker passively monitors the signal strength of the target’s cellular RF signal or WiFi RF signal and uses the strength of the signal (with directional antennas and/or from multiple listening points at once) …TechniqueCAPEC-619184Cellular Broadcast Message RequestIn this attack scenario, the attacker uses knowledge of the target’s mobile phone number (i.e., the number associated with the SIM used in the retransmission device) to cause the cellular network to send broadcast messages to alert the mobi…TechniqueCAPEC-618185Cellular Rogue Base StationIn this attack scenario, the attacker imitates a cellular base station with their own "rogue" base station equipment. Since cellular devices connect to whatever station has the strongest signal, the attacker can easily convince a targeted c…TechniqueCAPEC-617186Establish Rogue LocationAn adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource. After establishing the rogue location, the adversary waits for a victim to visit the location and acces…TechniqueCAPEC-616187Evil Twin Wi-Fi AttackAdversaries install Wi-Fi equipment that acts as a legitimate Wi-Fi network access point. When a device connects to this access point, Wi-Fi data traffic is intercepted, captured, and analyzed. This also allows the adversary to use "adversa…TechniqueCAPEC-615188Rooting SIM CardsSIM cards are the de facto trust anchor of mobile devices worldwide. The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones w…TechniqueCAPEC-614189WiFi SSID TrackingIn this attack scenario, the attacker passively listens for WiFi management frame messages containing the Service Set Identifier (SSID) for the WiFi network. These messages are frequently transmitted by WiFi access points (e.g., the retrans…TechniqueCAPEC-613190WiFi MAC Address TrackingIn this attack scenario, the attacker passively listens for WiFi messages and logs the associated Media Access Control (MAC) addresses. These addresses are intended to be unique to each wireless device (although they can be configured and c…TechniqueCAPEC-612191BitSquattingAn adversary registers a domain name one bit different than a trusted domain. A BitSquatting attack leverages random errors in memory to direct Internet traffic to adversary-controlled destinations. BitSquatting requires no exploitation or …TechniqueCAPEC-611192Cellular Data InjectionAdversaries inject data into mobile technology traffic (data flows or signaling data) to disrupt communications or conduct additional surveillance operations.TechniqueCAPEC-610193Session FixationThe attacker induces a client to establish a session with the target software using a session identifier provided by the attacker. Once the user successfully authenticates to the target software, the attacker uses the (now privileged) sessi…TechniqueCAPEC-61194Cellular Traffic InterceptCellular traffic for voice and data from mobile devices and retransmission devices can be intercepted via numerous methods. Malicious actors can deploy their own cellular tower equipment and intercept cellular traffic surreptitiously. Addit…TechniqueCAPEC-609195Cryptanalysis of Cellular EncryptionThe use of cryptanalytic techniques to derive cryptographic keys or otherwise effectively defeat cellular encryption to reveal traffic content. Some cellular encryption algorithms such as A5/1 and A5/2 (specified for GSM use) are known to b…TechniqueCAPEC-608196ObstructionAn attacker obstructs the interactions between system components. By interrupting or disabling these interactions, an adversary can often force the system into a degraded state or cause the system to stop working as intended. This can cause…TechniqueCAPEC-607197Weakening of Cellular EncryptionAn attacker, with control of a Cellular Rogue Base Station or through cooperation with a Malicious Mobile Network Operator can force the mobile device (e.g., the retransmission device) to use no encryption (A5/0 mode) or to use easily break…TechniqueCAPEC-606198Cellular JammingIn this attack scenario, the attacker actively transmits signals to overpower and disrupt the communication between a cellular user device and a cell tower. Several existing techniques are known in the open literature for this attack for 2G…TechniqueCAPEC-605199Wi-Fi JammingIn this attack scenario, the attacker actively transmits on the Wi-Fi channel to prevent users from transmitting or receiving data from the targeted Wi-Fi network. There are several known techniques to perform this attack – for example: the…TechniqueCAPEC-604200BlockageAn adversary blocks the delivery of an important system resource causing the system to fail or stop working.TechniqueCAPEC-603
AI/ML threats
AI system threats
Adversarial machine-learning techniques and tactics against AI-enabled systems, with published case studies and mitigations.
Techniques178
Case studies68
Mitigations37
Tactics16
Evidence stream
Techniques
01AI Agent ToolsAdversaries may create and publish poisoned AI agent tools. Poisoned tools may contain malicious model-visible definitions or instructions, hidden executable behavior, or runtime responses designed to manipulate an AI agent. Tools may be pu…TechniqueAML.T0115.00202ModelsAdversaries may publish poisoned AI models through model registries, code repositories, or other model distribution channels. The model may be newly created or a modified variant of a legitimate model and may contain manipulated weights, co…TechniqueAML.T0115.00103DatasetsAdversaries may publish poisoned datasets intended for training or fine-tuning AI models. The dataset may be newly created or a modified variant of a legitimate dataset and may contain manipulated samples, labels, annotations, or metadata. …TechniqueAML.T0115.00004Publish Poisoned AI ArtifactsAdversaries may create or modify AI artifacts and publish them through public or shared distribution channels to facilitate compromise of downstream AI systems. Poisoned AI artifacts may include datasets, models, and AI agent tools containi…TechniqueAML.T011505AI Service Web InterfaceAdversaries may communicate with compromised systems by abusing the web interface of an AI service as an intermediary command-and-control relay. Instead of connecting directly to attacker-controlled infrastructure or using an AI provider's …TechniqueAML.T011406Steal Web Session CookieAdversaries may steal web application or service session cookies used to authenticate users to AI-enabled systems, AI services, or supporting enterprise applications. Web applications often use session cookies as authentication tokens after…TechniqueAML.T011307AI ArtifactsAdversaries may achieve full system compromise by introducing malicious AI artifacts, such as models or data, that contain embedded malware or other malicious commands. AI artifacts are often stored in model registries or data stores and ma…TechniqueAML.T0112.00108Local AI AgentAdversaries may achieve full system compromise by abusing AI agents running locally on a host, such as computer-use agents or AI-driven browsers. These agents are designed to autonomously interact with the operating system, applications, an…TechniqueAML.T0112.00009Machine CompromiseAdversaries may compromise a machine by exploiting or manipulating AI-enabled components on the system. Compromising a victim system allows the adversary to execute arbitrary code, steal credentials, exfiltrate data, and continue to persist…TechniqueAML.T011210AI Supply Chain Reputation InflationAI Supply Chain Reputation Inflation is the process of building or leveraging genuinely credible-looking trust signals to increase the perceived legitimacy of AI supply chain components, with the goal of driving adoption of malicious or com…TechniqueAML.T011111Runtime ResponseAdversaries may poison the runtime response channel of a malicious or compromised AI agent tool by deliberately returning content intended to influence the model's subsequent reasoning, decisions, or actions. Poisoned responses may contain …TechniqueAML.T0110.00212ImplementationAdversaries may poison the executable implementation of an AI agent tool so that normal tool invocation produces unauthorized behavior or hidden side effects. The tool may continue to provide its represented functionality while also accessi…TechniqueAML.T0110.00113Definition and InstructionsAdversaries may poison the model-visible definition or operational instructions of an AI agent tool to manipulate how an agent interprets, selects, or invokes the tool. The poisoned content may be contained in tool descriptions, docstrings,…TechniqueAML.T0110.00014AI Agent Tool PoisoningAdversaries may poison tools used by AI agents by introducing or modifying malicious content or behavior in a tool's model-visible definition, executable implementation, or runtime responses. Tools may include built-in integrations, locally…TechniqueAML.T011015AI Supply Chain Rug PullAdversaries may publish legitimate AI components or software, gain user adoption, then push an update with a malicious variant, leading to [AI Supply Chain Compromise](/techniques/AML.T0010). More scrutiny is often placed on a supply chain …TechniqueAML.T010916AI AgentAdversaries may abuse AI agents present on the victim's system for command and control. AI agents are often granted access to tools that can execute shell commands, reach out to the internet, and interact with other services in the victim's…TechniqueAML.T010817Exploitation for Defense EvasionAdversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system…TechniqueAML.T010718Exploitation for Credential AccessAdversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating s…TechniqueAML.T010619Escape to HostAdversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In prin…TechniqueAML.T010520Deploy AI AgentAdversaries may launch AI agents in the victim's environment to execute actions on their behalf. AI agents may have access to a wide range of tools and data sources, as well as permissions to access and interact with other services and syst…TechniqueAML.T010321Generate Malicious CommandsAdversaries may use large language models (LLMs) to dynamically generate malicious commands from natural language. Dynamically generated commands may be harder to detect as the attack signature is constantly changing. AI-generated commands …TechniqueAML.T010222Data Destruction via AI Agent Tool InvocationAdversaries may invoke an AI agent's tool capable of performing mutative operations to perform Data Destruction. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to system…TechniqueAML.T010123AI Agent ClickbaitAdversaries may craft deceptive web content designed to bait Computer-Using AI agents or AI web browsers into taking unintended actions, such as clicking buttons, copying code, or navigating to specific web pages. These attacks exploit the …TechniqueAML.T010024AI Agent Tool Data PoisoningAdversaries may manipulate data in a victim-controlled, trusted, or connected data source that is accessible through an AI agent tool. Poisoned data may be placed in document repositories, databases, source-code repositories, knowledge base…TechniqueAML.T009925AI Agent Tool Credential HarvestingAdversaries may attempt to use their access to an AI agent on the victim's system to retrieve data from available agent tools to collect credentials. Agent tools may connect to a wide range of sources that may contain credentials including …TechniqueAML.T009826Virtualization/Sandbox EvasionAdversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment …TechniqueAML.T009727AI Service APIAdversaries may communicate using the API of an AI service on the victim's system. The adversary's commands to the victim system, and often the results, are embedded in the normal traffic of the AI service. An AI service API command and con…TechniqueAML.T009628Code RepositoriesAdversaries may search public code repositories for information about a victim or victim system that can be used during targeting. Victims may store code or artifacts related to their AI systems in repositories on various third-party websit…TechniqueAML.T0095.00029Search Open Websites/DomainsAdversaries may search public websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or domains owned by …TechniqueAML.T009530Delay Execution of LLM InstructionsAdversaries may include instructions to be followed by the AI system in response to a future event, such as a specific keyword or the next interaction, in order to evade detection or bypass controls placed on the AI system. For example, an …TechniqueAML.T009431Prompt Infiltration via Public-Facing ApplicationAn adversary may introduce malicious prompts into the victim's system via a public-facing application with the intention of it being ingested by an AI at some point in the future and ultimately having a downstream effect. This may occur whe…TechniqueAML.T009332Manipulate User LLM Chat HistoryAdversaries may manipulate a user's large language model (LLM) chat history to cover the tracks of their malicious behavior. They may hide persistent changes they have made to the LLM's behavior, or obscure their attempts at discovering pri…TechniqueAML.T009233Web Session CookieAdversaries may use stolen web session cookies to authenticate to AI-enabled applications and supporting services as another user. This technique may bypass some multi-factor authentication controls because the session represented by the co…TechniqueAML.T0091.00134Application Access TokenAdversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used …TechniqueAML.T0091.00035Use Alternate Authentication MaterialAdversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. AI services commonly…TechniqueAML.T009136OS Credential DumpingAdversaries may extract credentials from OS caches, application memory, or other sources on a compromised system. Credentials are often in the form of a hash or clear text, and can include usernames and passwords, application tokens, or oth…TechniqueAML.T009037Process DiscoveryAdversaries may attempt to get information about processes running on a system. Once obtained, this information could be used to gain an understanding of common AI-related software/applications running on systems within the network. Adminis…TechniqueAML.T008938Generate DeepfakesAdversaries may use generative artificial intelligence (GenAI) to create synthetic media (i.e. imagery, video, audio, and text) that appear authentic. These "[deepfakes]( https://en.wikipedia.org/wiki/Deepfake)" may mimic a real person or d…TechniqueAML.T008839Gather Victim Identity InformationAdversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, photos, etc.) as …TechniqueAML.T008740Exfiltration via AI Agent Tool InvocationAI agent tools capable of performing write operations may be invoked to exfiltrate data to an adversary. Sensitive information can be encoded into the tool's input parameters and transmitted to an adversary-controlled location (such as an i…TechniqueAML.T008641AI Agent ToolsAdversaries may prompt the AI service to invoke various tools the agent has access to. Tools may retrieve data from different APIs or services in an organization.TechniqueAML.T0085.00142RAG DatabasesAdversaries may prompt the AI service to retrieve data from a RAG database. This can include the majority of an organization's internal documents.TechniqueAML.T0085.00043Data from AI ServicesAdversaries may use their access to a victim organization's AI-enabled services to collect proprietary or otherwise sensitive information. As organizations adopt generative AI in centralized services for accessing an organization's data, su…TechniqueAML.T008544Call ChainsAdversaries may extract call chains from AI agent configurations, which can reveal potentially targets for remote code execution (RCE) or other vulnerabilities. Vulnerable call chains often connect user inputs or LLM outputs to an execution…TechniqueAML.T0084.00345Activation TriggersAdversaries may discover keywords or other triggers (such as incoming emails, documents being added, incoming message, or other workflows) that activate an agent and may cause it to run additional actions. Understanding these triggers can r…TechniqueAML.T0084.00246Tool DefinitionsAdversaries may discover the tools the AI agent has access to. By identifying which tools are available, the adversary can understand what actions may be executed through the agent and what additional resources it can reach. This knowledge …TechniqueAML.T0084.00147Embedded KnowledgeAdversaries may attempt to discover the data sources a particular agent can access. The AI agent's configuration may reveal data sources or knowledge. The embedded knowledge may include sensitive or proprietary material such as intellectual…TechniqueAML.T0084.00048Discover AI Agent ConfigurationAdversaries may attempt to discover configuration information for AI agents present on the victim's system. Agent configurations can include tools or services they have access to. Adversaries may directly access agent configuring dashboards…TechniqueAML.T008449Credentials from AI Agent ConfigurationAdversaries may access the credentials of other tools or services on a system from the configuration of an AI agent. AI Agents often utilize external tools or services to take actions, such as querying databases, invoking APIs, or interacti…TechniqueAML.T008350RAG Credential HarvestingAdversaries may attempt to use their access to a large language model (LLM) on the victim's system to collect credentials. Credentials may be stored in internal documents which can inadvertently be ingested into a RAG database, where they c…TechniqueAML.T008251Modify AI Agent ConfigurationAdversaries may modify the configuration files for AI agents on a system. This allows malicious changes to persist beyond the life of a single agent and affects any agents that share the configuration. Configuration changes may include modi…TechniqueAML.T008152ThreadAdversaries may introduce malicious instructions into a chat thread of a large language model (LLM) to cause behavior changes which persist for the remainder of the thread. A chat thread may continue for an extended period over multiple ses…TechniqueAML.T0080.00153MemoryAdversaries may manipulate the memory of a large language model (LLM) in order to persist changes to the LLM across future chat sessions. Memory is a common feature in LLMs that allows them to remember information across chat sessions by ut…TechniqueAML.T0080.00054AI Agent Context PoisoningAdversaries may attempt to manipulate the context used by an AI agent's large language model (LLM) to influence the responses it generates or actions it takes. This allows an adversary to persistently change the behavior of the target agent…TechniqueAML.T008055Stage CapabilitiesAdversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](/techniques/AML.T0017)) or o…TechniqueAML.T007956Drive-by CompromiseAdversaries may gain access to an AI system through a user visiting a website over the normal course of browsing, or an AI agent retrieving information from the web on behalf of a user. Websites can contain an [LLM Prompt Injection](/techni…TechniqueAML.T007857LLM Response RenderingAn adversary may get a large language model (LLM) to respond with private information that is hidden from the user when the response is rendered by the user's client. The private information is then exfiltrated. This can take the form of re…TechniqueAML.T007758Corrupt AI ModelAn adversary may purposefully corrupt a malicious AI model file so that it cannot be successfully deserialized in order to evade detection by a model scanner. The corrupt model may still successfully execute malicious code before deserializ…TechniqueAML.T007659Cloud Service DiscoveryAdversaries may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), software-as-a-service (SaaS), or AI-as-a-se…TechniqueAML.T007560MasqueradingAdversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated o…TechniqueAML.T007461ImpersonationAdversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via [Phishing](/techniques/AML.T0052), …TechniqueAML.T007362Reverse ShellAdversaries may utilize a reverse shell to communicate and control the victim system. Typically, a user uses a client to connect to a remote machine which is listening for connections. With a reverse shell, the adversary is listening for in…TechniqueAML.T007263False RAG Entry InjectionAdversaries may introduce false entries into a victim's retrieval augmented generation (RAG) database. Content designed to be interpreted as a document by the large language model (LLM) used in the RAG system is included in a data source be…TechniqueAML.T007164RAG PoisoningAdversaries may inject malicious content into data indexed by a retrieval augmented generation (RAG) system to contaminate a future thread through RAG-based search results. This may be accomplished by placing manipulated documents in a loca…TechniqueAML.T007065System PromptAdversaries may discover a large language model's system instructions provided by the AI system builder to learn about the system's capabilities and circumvent its guardrails.TechniqueAML.T0069.00266System Instruction KeywordsAdversaries may discover keywords that have special meaning to the large language model (LLM), such as function names or object names. These can later be exploited to confuse or manipulate the LLM into misbehaving and to make calls to plugi…TechniqueAML.T0069.00167Special Character SetsAdversaries may discover delimiters and special characters sets used by the large language model. For example, delimiters used in retrieval augmented generation applications to differentiate between context and user prompts. These can later…TechniqueAML.T0069.00068Discover LLM System InformationThe adversary is trying to discover something about the large language model's (LLM) system information. This may be found in a configuration file containing the system instructions or extracted via interactions with the LLM. The desired in…TechniqueAML.T006969LLM Prompt ObfuscationAdversaries may hide or otherwise obfuscate prompt injections or retrieval content to avoid detection from humans, large language model (LLM) guardrails, or other detection mechanisms. For text inputs, this may include modifying how the ins…TechniqueAML.T006870CitationsAdversaries may manipulate the citations provided in an AI system's response, in order to make it appear trustworthy. Variants include providing the wrong citation, making up a new citation, or providing the right citation but for adversary…TechniqueAML.T0067.00071LLM Trusted Output Components ManipulationAdversaries may utilize prompts to a large language model (LLM) which manipulate various components of its response in order to make it appear trustworthy to the user. This helps the adversary continue to operate in the victim's environment…TechniqueAML.T006772Retrieval Content CraftingAdversaries may write content designed to be retrieved by user queries and influence a user of the system in some way. This abuses the trust the user has in the system. The crafted content can be combined with a prompt injection. It can als…TechniqueAML.T006673LLM Prompt CraftingAdversaries may use their acquired knowledge of the target generative AI system to craft prompts that bypass its defenses and allow malicious instructions to be executed. The adversary may iterate on the prompt to ensure that it works as-in…TechniqueAML.T006574Gather RAG-Indexed TargetsAdversaries may identify data sources used in retrieval augmented generation (RAG) systems for targeting purposes. By pinpointing these sources, attackers can focus on poisoning or otherwise manipulating the external data repositories the A…TechniqueAML.T006475Discover AI Model OutputsAdversaries may discover model outputs, such as class scores, whose presence is not required for the system to function and are not intended for use by the end user. Model outputs may be found in logs or may be included in API responses. Mo…TechniqueAML.T006376Discover LLM HallucinationsAdversaries may prompt large language models and identify hallucinated entities. They may request software packages, commands, URLs, organization names, or e-mail addresses, and identify hallucinations with no connected real-world source. D…TechniqueAML.T006277LLM Prompt Self-ReplicationAn adversary may use a carefully crafted [LLM Prompt Injection](/techniques/AML.T0051) designed to cause the LLM to replicate the prompt as part of its output. This allows the prompt to propagate to other LLMs and persist on the system. The…TechniqueAML.T006178Publish Hallucinated EntitiesAdversaries may create an entity they control, such as a software package, website, or email address corresponding to a source hallucinated by an LLM. The hallucinations may take the form of package names, commands, URLs, company names, or …TechniqueAML.T006079Erode Dataset IntegrityAdversaries may poison or manipulate portions of a dataset to reduce its usefulness, reduce trust, and cause users to waste resources correcting errors.TechniqueAML.T005980LLM Data LeakageAdversaries may craft prompts that induce the LLM to leak sensitive information. This can include private user data or proprietary information. The leaked information may come from proprietary training data, data sources the LLM is connecte…TechniqueAML.T005781Extract LLM System PromptAdversaries may attempt to extract a large language model's (LLM) system prompt. Adversaries achieve this via prompt injection that induces the model to reveal its system prompt, or they may extract it from a configuration file. System prom…TechniqueAML.T005682Unsecured CredentialsAdversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. bash history), environment variable…TechniqueAML.T005583LLM JailbreakAdversaries may induce a large language model (LLM) to ignore, circumvent, or override its safety/alignment behaviors and/or guardrails to elicit outputs the model is intended to withhold. Once jailbroken, the LLM may be used in unintended …TechniqueAML.T005484AI Agent Tool InvocationAdversaries may use their access to an AI agent to invoke tools the agent has access to. LLMs are often connected to other services or resources via tools to increase their capabilities. Tools may include integrations with other application…TechniqueAML.T005385Deepfake-Assisted PhishingAdversaries may use deepfakes (AI-generated synthetic images, audio, or video) in phishing campaigns to impersonate trusted individuals, executives, or organizations. These attacks exploit human trust by presenting fraudulent voice or video…TechniqueAML.T0052.00186Spearphishing via Social Engineering LLMAdversaries may turn LLMs into targeted social engineers. LLMs are capable of interacting with users via text conversations. They can be instructed by an adversary to seek sensitive information from a user and act as effective social engine…TechniqueAML.T0052.00087PhishingAdversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, compa…TechniqueAML.T005288TriggeredAn adversary may trigger a prompt injection via a user action or event that occurs within the victim's environment. Triggered prompt injections often target AI agents, which can be activated by means the adversary identifies during [Discove…TechniqueAML.T0051.00289IndirectAn adversary may inject prompts indirectly via a separate data channel ingested by the LLM, such as text or multimedia pulled from databases or websites. These malicious prompts may be hidden or obfuscated from the user. This type of inject…TechniqueAML.T0051.00190DirectAn adversary may inject prompts directly as a user of the LLM. This type of injection may be used by the adversary to gain a foothold in the system or to misuse the LLM itself, as for example to generate harmful content.TechniqueAML.T0051.00091LLM Prompt InjectionAn adversary may craft malicious prompts as inputs to an LLM that cause the LLM to act in unintended ways. These "prompt injections" are often designed to cause the model to ignore aspects of its original instructions and follow the adversa…TechniqueAML.T005192Command and Scripting InterpreterAdversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most…TechniqueAML.T005093Exploit Public-Facing ApplicationAdversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, o…TechniqueAML.T004994AI Intellectual Property TheftAdversaries may exfiltrate AI artifacts to steal intellectual property and cause economic harm to the victim organization. Proprietary training data is costly to collect and annotate and may be a target for [Exfiltration](/tactics/AML.TA001…TechniqueAML.T0048.00495User HarmUser harms may encompass a variety of harm types including financial and reputational that are directed at or felt by individual victims of the attack rather than at the organization level.TechniqueAML.T0048.003
Evidence stream
Case studies
01Claude Code GitHub Action Secret ExposureThe [Microsoft Defender Security Research Team](https://www.microsoft.com/en-us/security/blog/author/windows-defender-research/) demonstrated that Anthropic's [Claude Code GitHub Action](https://github.com/anthropics/claude-code-action) cou…CampaignAML.CS006702ZombieAgent: Data Exfiltration Attack on ChatGPTZombieAgent is a proof-of-concept indirect prompt injection attack demonstrated by Radware against OpenAI's ChatGPT Deep Research and Connector functionality. The attacks showed how instructions concealed in externally controlled content, s…CampaignAML.CS006603Model Namespace Reuse Supply Chain AttackUnit 42 researchers demonstrated an AI supply chain attack in which an attacker reclaims a deleted Hugging Face author namespace and publishes a malicious model under the same historical Author/ModelName identifier. Applications and model c…CampaignAML.CS006504Poisoned GGUF Templates: Inference-Time Supply Chain AttackResearchers from Pillar Security and Fujitsu Research of Europe demonstrated an inference-time supply-chain backdoor in which poisoned chat templates alter model and agent behavior without modifying model weights. The backdoor is embedded i…CampaignAML.CS006405Prompt-Based Attacks Against Gemini via Calendar InvitationsSafeBreach researchers demonstrated how adversary-controlled instructions embedded in productivity content, including Google Calendar invitations, emails, and shared files, could influence the behavior of Gemini-powered assistants when that…CampaignAML.CS006306RCE Vulnerability in Semantic Kernel Search PluginThe [Microsoft Defender Security Research Team](https://www.microsoft.com/en-us/security/blog/author/windows-defender-research/) discovered a vulnerable path in Microsoft Semantic Kernel, in which a single prompt injection could lead to hos…CampaignAML.CS006207AI in the Middle: Web-Based AI Services as C2 RelaysCheck Point Research demonstrated an "AI in the Middle" attack in which malware can abuse web-based AI assistants with anonymous or unauthenticated browsing and URL-fetch capabilities as a covert command-and-control channel. The proof of co…CampaignAML.CS006108Cross-Site Scripting via Prompt Manipulation in Lenovo AI ChatbotCybernews researchers demonstrated that Lenovo's AI chatbot "Lena" was vulnerable to a prompt injection that produced malicious HTML which was saved in the chat history and could exfiltrate a human support agent's session cookie when render…CampaignAML.CS006009EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data ExfiltrationAim Security researchers discovered EchoLeak, a zero-click vulnerability in Microsoft 365 Copilot that could allow an attacker to exfiltrate sensitive enterprise data without user interaction. The attack used a prompt injection delivered vi…CampaignAML.CS005910Google Photos AI Model ExtractionSkyld researchers analyzed the Google Photos Android application and recovered TensorFlow Lite models used by AI-powered photo editing and image analysis features. The researchers found models stored unencrypted in the application's assets,…CampaignAML.CS005811Storm-2139 Azure OpenAI Guardrail BypassStorm-2139 built custom jailbreak tooling to bypass guardrails on Azure OpenAI Services, allowing users to generate harmful synthetic content. Microsoft reported that members of Storm-2139 scraped exposed customer credentials from public so…CampaignAML.CS005712Model Distillation Campaigns Targeting Anthropic ClaudeAnthropic uncovered campaigns to extract Claude's capabilities carried out by the three Chinese AI Labs: DeepSeek, Moonshot, and MiniMax. Collectively, these campaigns used approximately 24,000 accounts and 16 million queries. They used mod…CampaignAML.CS005613AI ClickFix: Hijacking Computer-Use Agents Using ClickFix[Embrace the Red]( https://embracethered.com/) demonstrated that AI computer-use agents are vulnerable to social engineering attacks and can be manipulated into executing arbitrary code on a victim's machine. The attack is a variation on "C…CampaignAML.CS005514Data Exfiltration via Remote Poisoned MCP ToolResearchers at Invariant Labs demonstrated that AI agents configured with remote Model Context Protocol (MCP) Tools can be vulnerable to model poisoning attacks. They show that an MCP Tool can contain malicious prompts in its docstring desc…CampaignAML.CS005415Poisoned Postmark MCP Server Email ExfiltrationA bad actor successfully exfiltrated emails from users of the Postmark's MCP server via a supply chain attack. Postmark is an email delivery service that allows organizations to send marketing and transactional emails via API. The Postmark …CampaignAML.CS005316LLMSmith: RCE Vulnerabilities in LLM-Integrated ApplicationsResearchers identified 20 remote code execution (RCE) vulnerabilities across 11 different LLM frameworks. They discovered applications deployed on the public internet built using these LLM frameworks and demonstrated the RCE vulnerabilities…CampaignAML.CS005217OpenClaw Command & Control via Prompt InjectionResearchers at HiddenLayer demonstrated how a webpage can embed an indirect prompt injection that causes OpenClaw to silently execute a malicious script. Once executed, the script plants persistent malicious instructions into future system …CampaignAML.CS005118OpenClaw 1-Click Remote Code ExecutionA security researcher demonstrated a 1-click remote code execution (RCE) vulnerability to the OpenClaw AI Agent via a malicious link containing a JavaScript script that only takes milliseconds to execute. This vulnerability has been reporte…CampaignAML.CS005019Supply Chain Compromise via Poisoned ClawdBot SkillA security researcher demonstrated a proof-of-concept supply chain attack using a poisoned ClawdBot Skill shared on ClawdHub, a Skill registry for agents. The poisoned Skill contained a prompt injection that caused ClawdBot to execute a she…CampaignAML.CS004920Exposed ClawdBot Control Interfaces Leads to Credential Access and ExecutionA security researcher identified hundreds of exposed ClawdBot control interfaces on the public internet. ClawdBot (now OpenClaw) "is a personal AI assistant you run on your own devices. It answers you on the channels you already use ... , p…CampaignAML.CS004821Code to Deploy Destructive AI Agent Discovered in Amazon Q VS Code ExtensionOn July 13th, 2025, a malicious actor using the GitHub username "lkmanka58" used an inappropriately scoped GitHub token to make a commit containing malicious code to the Amazon Q Developer Visual Studio Code (VS Code) extension repository. …CampaignAML.CS004722Data Destruction via Indirect Prompt Injection Targeting Claude Computer-UseSecurity researchers at HiddenLayer demonstrated that an indirect prompt injection targeting Claude's Computer Use AI can lead to execution of shell commands on the victim system and destruction of user data. The researchers embedded a prom…CampaignAML.CS004623Data Exfiltration via an MCP Server used by CursorThe Backslash Security Research Team demonstrated that a Model Context Protocol (MCP) tool can be used as a vector for an indirect prompt injection attack on Cursor, potentially leading to the execution of malicious shell commands. The Back…CampaignAML.CS004524LAMEHUG: Malware Leveraging Dynamic AI-Generated CommandsIn July 2025, Ukrainian authorities reported the emergence of LAMEHUG, a new AI-powered malware attributed to the Russian state-backed threat actor [APT28](https://attack.mitre.org/groups/G0007/) (also tracked as Forest Blizzard or UAC-0001…CampaignAML.CS004425Malware Prototype with Embedded Prompt InjectionCheck Point Research identified a prototype malware sample in the wild that contained a prompt injection, which appeared to be designed to manipulate LLM-based malware detectors and/or analysis tools. However, the researchers did not find t…CampaignAML.CS004326SesameOp: Novel backdoor uses OpenAI Assistants API for command and controlThe Microsoft Incident Response - Detection and Response Team (DART) investigated a compromised system where a threat actor utilized SesameOp, a backdoor implant that abuses the OpenAI Assistants API as a covert command and control channel,…CampaignAML.CS004227Rules File Backdoor: Supply Chain Attack on AI Coding AssistantsPillar Security researchers demonstrated how adversaries can compromise AI-generated code by injecting malicious instructions into rules files used to configure AI coding assistants like Cursor and GitHub Copilot. The attack uses invisible …CampaignAML.CS004128Hacking ChatGPT's Memories with Prompt Injection[Embrace the Red](https://embracethered.com/blog/) demonstrated that ChatGPT's memory feature is vulnerable to manipulation via prompt injections. To execute the attack, the researcher hid a prompt injection in a shared Google Doc. When a u…CampaignAML.CS004029Living Off AI: Prompt Injection via Jira Service ManagementResearchers from Cato Networks demonstrated how adversaries can exploit AI-powered systems embedded in enterprise workflows to execute malicious actions with elevated privileges. This is achieved by crafting malicious inputs from external u…CampaignAML.CS003930Planting Instructions for Delayed Automatic AI Agent Tool Invocation[Embrace the Red](https://embracethered.com/blog/) demonstrated that Google Gemini is susceptible to automated tool invocation by delaying the execution to the next conversation turn. This bypasses a security control that restricts Gemini f…CampaignAML.CS003831Data Exfiltration via Agent Tools in Copilot StudioResearchers from Zenity demonstrated how an organization's data can be exfiltrated via prompt injections that target an AI-powered customer service agent. The target system is a customer service agent built by Zenity in Copilot Studio. It i…CampaignAML.CS003732AIKatz: Attacking LLM Desktop ApplicationsResearchers at Lumia have demonstrated that it is possible to extract authentication tokens from the memory of LLM Desktop Applications. An attacker could then use those tokens to impersonate the victim to the LLM backend, thereby gaining a…CampaignAML.CS003633Data Exfiltration from Slack AI via Indirect Prompt Injection[PromptArmor](https://promptarmor.substack.com) demonstrated that private data can be exfiltrated from Slack AI via indirect prompt injections. The attack relied on Slack AI ingesting a malicious prompt from a post in a public channel into …CampaignAML.CS003534ProKYC: Deepfake Tool for Account Fraud AttacksCato CTRL security researchers have identified ProKYC, a deepfake tool being sold to cybercriminals as a method to bypass Know Your Customer (KYC) verification on financial service applications such as cryptocurrency exchanges. ProKYC can c…CampaignAML.CS003435Live Deepfake Image Injection to Evade Mobile KYC VerificationFacial biometric authentication services are commonly used by mobile applications for user onboarding, authentication, and identity verification for KYC requirements. The iProov Red Team demonstrated a face-swapped imagery injection attack …CampaignAML.CS003336Attempted Evasion of ML Phishing Webpage Detection SystemAdversaries create phishing websites that appear visually similar to legitimate sites. These sites are designed to trick users into entering their credentials, which are then sent to the bad actor. To combat this behavior, security companie…CampaignAML.CS003237Malicious Models on Hugging FaceResearchers at ReversingLabs have identified malicious models containing embedded malware hosted on the Hugging Face model repository. The models were found to execute reverse shells when loaded, which grants the threat actor command and co…CampaignAML.CS003138LLM JackingThe Sysdig Threat Research Team discovered that malicious actors utilized stolen credentials to gain access to cloud-hosted large language models (LLMs). The actors covertly gathered information about which models were enabled on the cloud …CampaignAML.CS003039Google Bard Conversation Exfiltration[Embrace the Red](https://embracethered.com/blog/) demonstrated that Bard users' conversations could be exfiltrated via an indirect prompt injection. To execute the attack, a threat actor shares a Google Doc containing the prompt with the t…CampaignAML.CS002940AI Model Tampering via Supply Chain AttackResearchers at Trend Micro, Inc. used service indexing portals and web searching tools to identify over 8,000 misconfigured private container registries exposed on the internet. Approximately 70% of the registries also had overly permissive…CampaignAML.CS002841Organization Confusion on Hugging Face[threlfall_hax](https://5stars217.github.io/), a security researcher, created organization accounts on Hugging Face, a public model repository, that impersonated real organizations. These false Hugging Face organization accounts looked legi…CampaignAML.CS002742Financial Transaction Hijacking with M365 Copilot as an InsiderResearchers from Zenity conducted a red teaming exercise in August 2024 that successfully manipulated Microsoft 365 Copilot.[[twitter]] The attack abused the fact that Copilot ingests received emails into a retrieval augmented generation (R…CampaignAML.CS002643Web-Scale Data Poisoning: Split-View AttackMany recent large-scale datasets are distributed as a list of URLs pointing to individual datapoints. The researchers show that many of these datasets are vulnerable to a "split-view" poisoning attack. The attack exploits the fact that the …CampaignAML.CS002544Morris II Worm: RAG-Based AttackResearchers developed Morris II, a zero-click worm designed to attack generative AI (GenAI) ecosystems and propagate between connected GenAI systems. The worm uses an adversarial self-replicating prompt which uses prompt injection to replic…CampaignAML.CS002445ShadowRay: Hijacking Exposed Ray ClustersRay is an open-source Python framework for scaling production AI workflows. Ray's Job API allows for arbitrary remote execution by design. However, it does not offer authentication, and the default configuration may expose the cluster to th…CampaignAML.CS002346ChatGPT Package HallucinationResearchers identified that large language models such as ChatGPT can hallucinate fake software package names that are not published to a package repository. An attacker could publish a malicious package under the hallucinated name to a pac…CampaignAML.CS002247ChatGPT Conversation Exfiltration[Embrace the Red](https://embracethered.com/blog/) demonstrated that ChatGPT users' conversations can be exfiltrated via an indirect prompt injection. To execute the attack, a threat actor uploads a malicious prompt to a public website, whe…CampaignAML.CS002148Indirect Prompt Injection Threats: Bing Chat Data PirateWhenever interacting with Microsoft's new Bing Chat LLM Chatbot, a user can allow Bing Chat permission to view and access currently open websites throughout the chat session. Researchers demonstrated the ability for an attacker to plant an …CampaignAML.CS002049PoisonGPTResearchers from Mithril Security demonstrated how to poison an open-source pre-trained large language model (LLM) to return a false fact. They then successfully uploaded the poisoned model back to HuggingFace, the largest publicly-accessib…CampaignAML.CS001950Arbitrary Code Execution with Google ColabGoogle Colab is a Jupyter Notebook service that executes on virtual machines. Jupyter Notebooks are often used for ML and data science research and experimentation, containing executable snippets of Python code and common Unix command-line …CampaignAML.CS001851Bypassing ID.me Identity VerificationAn individual filed at least 180 false unemployment claims in the state of California from October 2020 to December 2021 by bypassing ID.me's automated identity verification system. Dozens of fraudulent claims were approved and the individu…CampaignAML.CS001752Achieving Code Execution in MathGPT via Prompt InjectionThe publicly available Streamlit application [MathGPT](https://mathgpt.streamlit.app/) uses GPT-3, a large language model (LLM), to answer user-generated math questions. Recent studies and experiments have shown that LLMs such as GPT-3 show…CampaignAML.CS001653Compromised PyTorch Dependency ChainLinux packages for PyTorch's pre-release version, called Pytorch-nightly, were compromised from December 25 to 30, 2022 by a malicious binary uploaded to the Python Package Index (PyPI) code repository. The malicious binary had the same nam…CampaignAML.CS001554Confusing Antimalware Neural NetworksCloud storage and computations have become popular platforms for deploying ML malware detectors. In such cases, the features for models are built on users' systems and then sent to cybersecurity company servers. The Kaspersky ML research te…CampaignAML.CS001455Backdoor Attack on Deep Learning Models in Mobile AppsDeep learning models are increasingly used in mobile applications as critical components. Researchers from Microsoft Research demonstrated that many deep learning models deployed in mobile apps are vulnerable to backdoor attacks via "neural…CampaignAML.CS001356Face Identification System Evasion via Physical CountermeasuresMITRE's AI Red Team demonstrated a physical-domain evasion attack on a commercial face identification service with the intention of inducing a targeted misclassification. This operation had a combination of traditional MITRE ATT&CK techniqu…CampaignAML.CS001257Microsoft Edge AI EvasionThe Azure Red Team performed a red team exercise on a new Microsoft product designed for running AI workloads at the edge. This exercise was meant to use an automated system to continuously manipulate a target image to cause the ML model to…CampaignAML.CS001158Microsoft Azure Service DisruptionThe Microsoft AI Red Team performed a red team exercise on an internal Azure service with the intention of disrupting its service. This operation had a combination of traditional ATT&CK enterprise techniques such as finding valid account, a…CampaignAML.CS001059Tay PoisoningMicrosoft created Tay, a Twitter chatbot designed to engage and entertain users. While previous chatbots used pre-programmed scripts to respond to prompts, Tay's machine learning capabilities allowed it to be directly influenced by its conv…CampaignAML.CS000960ProofPoint EvasionProof Pudding (CVE-2019-20634) is a code repository that describes how ML researchers evaded ProofPoint's email protection system by first building a copy-cat email protection ML model, and using the insights to bypass the live system. More…CampaignAML.CS000861GPT-2 Model ReplicationOpenAI built GPT-2, a language model capable of generating high quality text samples. Over concerns that GPT-2 could be used for malicious purposes such as impersonating others, or generating misleading news articles, fake social media cont…CampaignAML.CS000762ClearviewAI MisconfigurationClearview AI makes a facial recognition tool that searches publicly available photos for matches. This tool has been used for investigative purposes by law enforcement agencies and other parties. Clearview AI's source code repository, thoug…CampaignAML.CS000663Attack on Machine Translation ServicesMachine translation services (such as Google Translate, Bing Translator, and Systran Translate) provide public-facing UIs and APIs. A research group at UC Berkeley utilized these public endpoints to create a replicated model with near-produ…CampaignAML.CS000564Camera Hijack Attack on Facial Recognition SystemThis type of camera hijack attack can evade the traditional live facial recognition authentication model and enable access to privileged systems and victim impersonation. Two individuals in China used this attack to gain access to the local…CampaignAML.CS000465Bypassing Cylance's AI Malware DetectionResearchers at Skylight were able to create a universal bypass string that evades detection by Cylance's AI Malware detector when appended to a malicious file.CampaignAML.CS000366VirusTotal PoisoningMcAfee Advanced Threat Research noticed an increase in reports of a certain ransomware family that was out of the ordinary. Case investigation revealed that many samples of that particular ransomware family were submitted through a popular …CampaignAML.CS000267Botnet Domain Generation Algorithm (DGA) Detection EvasionThe Palo Alto Networks Security AI research team was able to bypass a Convolutional Neural Network based botnet Domain Generation Algorithm (DGA) detector using a generic domain name mutation technique. It is a generic domain mutation techn…CampaignAML.CS000168Evasion of Deep Learning Detector for Malware C&C TrafficThe Palo Alto Networks Security AI research team tested a deep learning model for malware command and control (C&C) traffic detection in HTTP traffic. Based on the publicly available [paper by Le et al.](https://arxiv.org/abs/1802.03162), w…CampaignAML.CS0000