Analytics BIOC
Low
✕
Unusual AI RAG Knowledge Base Modification
AI knowledge base was modified by an identity that typically doesn't interact with knowledge bases. MITRE ATLAS Technique: AML.T0070 - RAG Poisoning. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log, Gcp Audit Log
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Data Manipulation: Stored Data Manipulation (T1565.001)
Detector tags: Cloud AI Infrastructure Analytics
Attacker's goals:
Contaminating knowledge base, so that contextual information will be incorrect, biased or harmful.
Investigative actions:
Check the identity that modified the knowledge base. Check recent additions to the knowledge base.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days