AI model discovery

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags	Cloud AI Infrastructure Analytics
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Low

Description

A cloud identity listed available AI models. This behavior often suggests reconnaissance on AI models and potential misuse. MITRE ATLAS Technique: AML.T0007 - Discover ML Artifacts.

Attacker's Goals

Gather information about AI models in the environment.

Investigative actions

• Determine which AI models were enumerated.
• Monitor the usage of affected AI models to detect potential misuse, such as unusual or excessive access attempts.
• Investigate any unusual activity originating from the suspected identity.