Unusual AI dataset modification

Analytics BIOC Low

Unusual AI dataset modification

A cloud identity modified an AI dataset. MITRE ATLAS Techniques: AML.T0059 - Erode Dataset Integrity, AML.T0018.000 - Backdoor ML Model: Poison ML Model. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log, Azure Audit Log, Gcp Audit Log

ATT&CK tactics: Impact (TA0040)

ATT&CK techniques: Data Manipulation: Stored Data Manipulation (T1565.001)

Detector tags: Cloud AI Infrastructure Analytics

Attacker's goals:

Poison datasets used by ML models.

Investigative actions:

Examine changed datasets and determine which ML models were affected. Investigate any unusual activity originating from the suspected identity.

Test period:: N/A (single event)
Deduplication:: 5 Days

1 variation:

Unusual AI dataset modification from an internal IP address Informational (parent: Low)