{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1700","id":"T1700","name":"AI-Enabled Exfiltration","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1700","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"009794c7662b4a7157ec58623ee48e94471e801b7ceae7ac323fccbbc71cf5e7","description":"Adversaries may utilize [Direct Prompt Injection](https://attack.mitre.org/techniques/T1699), [Indirect Prompt Injection](https://attack.mitre.org/techniques/T1698) or other methods to instruct enterprise AI agents to exfiltrate data.(Citation: Prompt-Injection Exfil)(Citation: Anthropic Report Sep 2026) When enterprise systems incorporate the use of AI assistants or other AI agents, adversaries may abuse these systems to weaponize sanctioned tools available to the agent.(Citation: Google Security State of Prompt Injections) \n\nAs an AI agent processes queries or ingests data, an injected prompt can cause the agent to use its tool connections in unauthorized or unintended ways. When AI agents are induced to exfiltrate data, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001) or [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567).(Citation: Google Cloud AI Risk Sep 2026)(Citation: Barracuda Prompt Injection Phishing Emails)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1700","external_id":"T1700"},{"source_name":"Anthropic Report Sep 2026","description":"Anthropic Threat Intelligence Team. (2026, September 10). Detecting and countering misuse of AI: September 2026. Retrieved September 21, 2026.","url":"https://www.anthropic.com/threat-intelligence-report-september-2026"},{"source_name":"Google Cloud AI Risk Sep 2026","description":"Google Cloud Security. (2026, September). AI risk and resilience | A Mandiant special report. Retrieved September 21, 2026.","url":"https://cloud.google.com/security/resources/ai-risk-and-resilience-2026"},{"source_name":"Barracuda Prompt Injection Phishing Emails","description":"Guruprasad Kenja. (2026, October 6). Threat Spotlight: Email attacks target both humans and AI in the same message. Retrieved October 8, 2026.","url":"https://blog.barracuda.com/2026/10/07/email-attacks-target-both-humans-ai-assistants"},{"source_name":"Prompt-Injection Exfil","description":"Md Habibur Rahman and Jaeho Kim. (2026, August 27). The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents. Retrieved September 21, 2026.","url":"https://arxiv.org/html/2608.27092"},{"source_name":"Google Security State of Prompt Injections","description":"Thomas Brunner, Yu-Han Liu, and Moni Pande. (2026, April 23). AI threats in the wild: The current state of prompt injections on the web. Retrieved September 21, 2026.","url":"https://blog.google/security/prompt-injections-web/"}],"platforms":["Windows","SaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0029","name":"Script Execution","page":"telemetry/DC0029/","kind":"attack_component","category":"Script and command execution","description":"Script content or script execution observations from an interpreter-aware sensor.","collection_focus":"Collect PowerShell 4104 with script-block ID and fragment sequence; instrument other engines separately rather than assigning them the same event ID.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":{"label":"Read recent Windows PowerShell script-block events","language":"powershell","source_id":"powershell","content":"Get-WinEvent -FilterHashtable @{\n  LogName = 'Microsoft-Windows-PowerShell/Operational'\n  Id = 4104\n} -MaxEvents 5","note":"Read-only check after Script Block Logging is configured. For PowerShell 7 use its registered PowerShellCore/Operational channel. Missing events are not proof of no execution; check policy, channel and permissions."},"required_fields":["engine","script_block_id","fragment","fragments_total","script_text"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0029","collector":"illustrative-lab-collector","observation":{"engine":"PowerShell","script_block_id":"lab-script-1","fragment":1,"fragments_total":1,"script_text":"Write-Output \"LAB_TELEMETRY_CHECK\""}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."}],"detection":{"key":"enterprise/T1700","id":"T1700","name":"AI-Enabled Exfiltration","domain":"enterprise","platforms":["Windows","SaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1700","technique_page":"techniques/enterprise/T1700/","page":"detections/enterprise/T1700/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0927","name":"Detect AI-Enabled Exfiltration","url":"https://attack.mitre.org/detectionstrategies/DET0927","stix_id":"x-mitre-detection-strategy--0567c079-3df3-404a-b69d-1690efd638b4","relationship_id":"relationship--25ffc046-d3eb-4691-87bc-b27f5340b796","description":"","analytics":[{"id":"AN2079","name":"Analytic 2079","guidance":"An analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection to a destination outside $AuthorizedAIEndpoints$ from the same process lineage.","url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2079","platforms":["Windows"],"tuning":[{"field":"AuthorizedAIDataScope","description":"data paths/classes the AI application/service identity is permitted to access; derive from application design, IAM and data policy"},{"field":"ExpectedAIProcessTree","description":"approved AI parent/child relationships from clean executions"},{"field":"AuthorizedAIEndpoints","description":"legitimate service/repository/API destinations"},{"field":"EndpointExfilWindow","description":"access→execution→egress timing derived from clean workflows"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","platforms":["Windows"],"analytic_id":"AN2079","source_url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2079","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0029","component":"Script Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN2079","source_url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2079","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0029/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN2079","source_url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2079","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN2078","name":"Analytic 2078","guidance":"An analyst observes an AI agent access $ProtectedDataScope$, invoke a tool/API using that information or a derived payload, and the destination service record a successful transfer to a recipient, repository, tenant, domain, or service outside $AuthorizedAIDataFlows$.","url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2078","platforms":["SaaS"],"tuning":[{"field":"ProtectedDataScope","description":"protected information"},{"field":"AuthorizedAgentActions","description":"tools/functions legitimately available for workflow"},{"field":"AuthorizedAIDataFlows","description":"allowed source→tool→destination relationships"},{"field":"AuthorizedAIOutputDestinations","description":"permitted recipients/domains/tenants/repos/connectors"},{"field":"AIExfiltrationWindow","description":"normal access→transfer interval"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"saas:audit","channel":"Actual send/share/upload/write operation","platforms":["SaaS"],"analytic_id":"AN2078","source_url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2078","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0038","component":"Application Log Content","name":"AWS:bedrock","channel":"AgentTrace.actionGroupInvocationInput","platforms":["SaaS"],"analytic_id":"AN2078","source_url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2078","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0038","component":"Application Log Content","name":"AWS:bedrock","channel":"AgentTrace.knowledgeBaseLookupInput","platforms":["SaaS"],"analytic_id":"AN2078","source_url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2078","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2080","name":"Analytic 2080","guidance":"An analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection from the same lineage to a destination outside $AuthorizedAIEndpoints$.","url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2080","platforms":["Linux"],"tuning":[{"field":"AuthorizedAIDataScope","description":"data paths/classes the AI application/service identity is permitted to access; derive from application design, IAM and data policy"},{"field":"ExpectedAIProcessTree","description":"approved AI parent/child relationships from clean executions"},{"field":"AuthorizedAIEndpoints","description":"legitimate service/repository/API destinations"},{"field":"EndpointExfilWindow","description":"access→execution→egress timing derived from clean workflows"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open/read","platforms":["Linux"],"analytic_id":"AN2080","source_url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2080","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"EXECVE","platforms":["Linux"],"analytic_id":"AN2080","source_url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2080","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"connect","platforms":["Linux"],"analytic_id":"AN2080","source_url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2080","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0029","name":"Script Execution","tag":"Script Execution","page":"telemetry/DC0029/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Employ user training to include the implications of AI agent use within corporate environments ","relationship_id":"relationship--635477d8-e634-4f6b-acdf-2cccb27061fa","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Restrict file permissions to limit the exposure of sensitive data from AI agents. ","relationship_id":"relationship--f41d077c-c8f4-485b-b557-54231e82be7f","references":[]},{"id":"M1048","name":"Application Isolation and Sandboxing","url":"https://attack.mitre.org/mitigations/M1048","kind":"course-of-action","description":"Ensuring that LLM/AI systems are contained to only within the organizational network with no outside access can contain the exfiltration of sensitive data to within an organizational network.  ","relationship_id":"relationship--93499a37-35b3-4b66-8275-b53542c4341f","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1699":"/ttp-simulation/techniques/enterprise/T1699/","T1698":"/ttp-simulation/techniques/enterprise/T1698/","T1567.001":"/ttp-simulation/techniques/enterprise/T1567.001/","T1567":"/ttp-simulation/techniques/enterprise/T1567/","T1700":"/ttp-simulation/techniques/enterprise/T1700/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1700","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0029","collector":"illustrative-lab-collector","observation":{"engine":"PowerShell","script_block_id":"lab-script-1","fragment":1,"fragments_total":1,"script_text":"Write-Output \"LAB_TELEMETRY_CHECK\""}}]}}