Analytics Low

Potential denial of wallet abusing AI services

An ML model experienced a sudden spike in requests in a short time. MITRE ATLAS Techniques: AML.T0029 - Denial of ML Service, AML.T0034 - Cost Harvesting. OWASP Top 10 LLM Technique: LLM10 - Unbounded Consumption.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Endpoint Denial of Service: Application Exhaustion Flood (T1499.003) Resource Hijacking (T1496)
Detector tags: Cloud AI Infrastructure Analytics
Attacker's goals:

Disrupting or shutting down an ML service.

Investigative actions:

Investigate the impact on the ML service.

Test period:
10 Minutes
Deduplication:
5 Days
1 variation:
  • Possible denial of wallet abusing AI services Medium (parent: Low)