Unusual AI dataset modification

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags	Cloud AI Infrastructure Analytics
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Data Manipulation: Stored Data Manipulation (T1565.001)
Severity	Low

Description

A cloud identity modified an AI dataset. MITRE ATLAS Techniques: AML.T0059 - Erode Dataset Integrity, AML.T0018.000 - Backdoor ML Model: Poison ML Model. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning.

Attacker's Goals

Poison datasets used by ML models.

Investigative actions

• Examine changed datasets and determine which ML models were affected.
• Investigate any unusual activity originating from the suspected identity.

Variations

Unusual AI dataset modification from an internal IP address

Synopsis

Field	Value
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Data Manipulation: Stored Data Manipulation (T1565.001)
Severity	Informational

Description

A cloud identity modified an AI dataset. MITRE ATLAS Techniques: AML.T0059 - Erode Dataset Integrity, AML.T0018.000 - Backdoor ML Model: Poison ML Model. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning.

Attacker's Goals

Poison datasets used by ML models.

Investigative actions

• Examine changed datasets and determine which ML models were affected.
• Investigate any unusual activity originating from the suspected identity.