Unusual AI Knowledge Base Modification

Analytics BIOC Low

Unusual AI Knowledge Base Modification

An AI knowledge base was modified by an identity that typically doesn't interact with knowledge bases. MITRE ATLAS Technique: AML.T0070 - RAG Poisoning. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log, Gcp Audit Log

ATT&CK tactics: Impact (TA0040)

ATT&CK techniques: Data Manipulation: Stored Data Manipulation (T1565.001)

Detector tags: Cloud AI Infrastructure Analytics

Attacker's goals:

Contaminating knowledge base, so that contextual information will be incorrect, biased or harmful.

Investigative actions:

Check the identity that modified the knowledge base. Check recent additions to the knowledge base.

Test period:: N/A (single event)
Deduplication:: 5 Days

1 variation:

Suspicious AI Knowledge Base Modification Medium (parent: Low)