MITRE ATLAS Matrix

AML.TA0002ATT&CK TA0043

• Search Open Technical DatabasesAML.T0000
  • Journals and Conference Proceedings.000
  • Pre-Print Repositories.001
  • Technical Blogs.002
  • Scan Databases.003
• Search Open AI Vulnerability AnalysisAML.T0001
• Search Victim-Owned WebsitesAML.T0003
• Search Application RepositoriesAML.T0004
• Active ScanningAML.T0006
  • Enumerate Hosted AI Resources.000
  • Query Platform Metadata APIs.001
  • Scan for Exposed AI Infrastructure.002
  • Probe AI Agent Trigger Channels.003
• Gather RAG-Indexed TargetsAML.T0064
• Gather Victim Identity InformationAML.T0087
• Search Open Websites/DomainsAML.T0095
  • Code Repositories.000
• Autonomous ReconnaissanceAML.T0116

AML.TA0003ATT&CK TA0042

• Acquire Public AI ArtifactsAML.T0002
  • Datasets.000
  • Models.001
  • AI Agent Configuration.002
• Acquire InfrastructureAML.T0008
  • AI Development Workspaces.000
  • Consumer Hardware.001
  • Domains.002
  • Physical Countermeasures.003
  • Serverless.004
  • AI Service Proxies.005
• Obtain CapabilitiesAML.T0016
  • Adversarial AI Attack Implementations.000
  • Software Tools.001
  • Generative AI.002
  • Exploits.003
  • AI Agent Tools.004
• Develop CapabilitiesAML.T0017
  • Adversarial AI Attacks.000
  • Autonomous Exploit Development.001
  • AI Agent Tools.002
• Establish AccountsAML.T0021
• Publish Hallucinated EntitiesAML.T0060
• Stage CapabilitiesAML.T0079
• Publish Poisoned AI ArtifactsAML.T0115
  • Datasets.000
  • Models.001
  • AI Agent Tools.002
• Compromise InfrastructureAML.T0128

AML.TA0001ATLAS only

• Create Proxy AI ModelAML.T0005
  • Train Proxy via Gathered AI Artifacts.000
  • Train Proxy via Replication.001
  • Use Pre-Trained Model.002
• Manipulate AI ModelAML.T0018
  • Poison AI Model.000
  • Modify AI Model Architecture.001
  • Embed Malware.002
  • Modify Prompt Construction Logic.003
• Verify AttackAML.T0042
• Craft Adversarial DataAML.T0043
  • White-Box Optimization.000
  • Black-Box Optimization.001
  • Black-Box Transfer.002
  • Manual Modification.003
  • Insert Backdoor Trigger.004
• LLM Prompt CraftingAML.T0065
• Retrieval Content CraftingAML.T0066
• Generate DeepfakesAML.T0088
• Generate Malicious CommandsAML.T0102
• Autonomous Attack-Path AdaptationAML.T0117
• Autonomous AI Agent CommunicationAML.T0118
  • Communication via Shared Artifacts.000
  • Direct Agent Communication.001
• Autonomous Attack OrchestrationAML.T0124

AML.TA0004ATT&CK TA0001

• AI Supply Chain CompromiseAML.T0010
  • Hardware.000
  • AI Software.001
  • Data.002
  • Model.003
  • Container Registry.004
  • AI Agent Tool.005
• Valid AccountsAML.T0012
• Evade AI ModelAML.T0015
• Exploit Public-Facing ApplicationAML.T0049
• PhishingAML.T0052
  • Spearphishing via Social Engineering LLM.000
  • Deepfake-Assisted Phishing.001
• Drive-by CompromiseAML.T0078
• Prompt Infiltration via Public-Facing ApplicationAML.T0093
• Exploit Automated Artifact Processing PipelineAML.T0119
• Crafted AI Assistant LinksAML.T0131
• Misconfigured or Publicly Exposed AI ServicesAML.T0132

AML.TA0000ATLAS only

• AI Model Inference API AccessAML.T0040
• Physical Environment AccessAML.T0041
• Full AI Model AccessAML.T0044
• AI-Enabled Product or ServiceAML.T0047

AML.TA0005ATT&CK TA0002

• User ExecutionAML.T0011
  • Unsafe AI Artifacts.000
  • Malicious Package.001
  • Poisoned AI Agent Tool.002
  • Malicious Link.003
• Command and Scripting InterpreterAML.T0050
• LLM Prompt InjectionAML.T0051
  • Direct.000
  • Indirect.001
  • Triggered.002
• AI Agent Tool InvocationAML.T0053
• AI Agent ClickbaitAML.T0100
• Deploy AI AgentAML.T0103

AML.TA0006ATT&CK TA0003

• Manipulate AI ModelAML.T0018
  • Poison AI Model.000
  • Modify AI Model Architecture.001
  • Embed Malware.002
  • Modify Prompt Construction Logic.003
• Training Data PoisoningAML.T0020
• LLM Prompt Self-ReplicationAML.T0061
• RAG PoisoningAML.T0070
• AI Agent Context PoisoningAML.T0080
  • Memory.000
  • Thread.001
• Modify AI Agent ConfigurationAML.T0081
• Prompt Infiltration via Public-Facing ApplicationAML.T0093
• AI Agent Tool Data PoisoningAML.T0099
• AI Agent Tool PoisoningAML.T0110
  • Definition and Instructions.000
  • Implementation.001
  • Runtime Response.002
• AI Agent Environment ReconstructionAML.T0121
• Create AccountAML.T0125

AML.TA0012ATT&CK TA0004

• Valid AccountsAML.T0012
• AI Agent Tool InvocationAML.T0053
• LLM JailbreakAML.T0054
• Escape to HostAML.T0105

AML.TA0007ATT&CK TA0005

• Evade AI ModelAML.T0015
• LLM JailbreakAML.T0054
• LLM Trusted Output Components ManipulationAML.T0067
  • Citations.000
• LLM Prompt ObfuscationAML.T0068
• False RAG Entry InjectionAML.T0071
• ImpersonationAML.T0073
• MasqueradingAML.T0074
• Corrupt AI ModelAML.T0076
• Modify AI Agent ConfigurationAML.T0081
• Manipulate User LLM Chat HistoryAML.T0092
• Delay Execution of LLM InstructionsAML.T0094
• Virtualization/Sandbox EvasionAML.T0097
• Exploitation for Defense EvasionAML.T0107
• AI Supply Chain Rug PullAML.T0109
• AI Supply Chain Reputation InflationAML.T0111
• Obfuscated Files or InformationAML.T0123
• Triggers in Multimodal InputsAML.T0129
• AI Targeted CloakingAML.T0134

AML.TA0013ATT&CK TA0006

• Unsecured CredentialsAML.T0055
• RAG Credential HarvestingAML.T0082
• Credentials from AI Agent ConfigurationAML.T0083
• OS Credential DumpingAML.T0090
• AI Agent Tool Credential HarvestingAML.T0098
• Exploitation for Credential AccessAML.T0106
• Steal Web Session CookieAML.T0113

AML.TA0008ATT&CK TA0007

• Discover AI ArtifactsAML.T0007
• Discover AI Model OntologyAML.T0013
• Discover AI Model FamilyAML.T0014
• Discover LLM HallucinationsAML.T0062
• Discover AI Model OutputsAML.T0063
• Discover LLM System InformationAML.T0069
  • Special Character Sets.000
  • System Instruction Keywords.001
  • System Prompt.002
• Enterprise Resource DiscoveryAML.T0075
• Discover AI Agent ConfigurationAML.T0084
  • Embedded Knowledge.000
  • Tool Definitions.001
  • Activation Triggers.002
  • Call Chains.003
• Enterprise Environment DiscoveryAML.T0089
• Discover AI Agent Runtime CapabilitiesAML.T0133

AML.TA0015ATT&CK TA0008

• Valid AccountsAML.T0012
• PhishingAML.T0052
  • Spearphishing via Social Engineering LLM.000
  • Deepfake-Assisted Phishing.001
• AI Agent Tool InvocationAML.T0053
• Use Alternate Authentication MaterialAML.T0091
  • Application Access Token.000
  • Web Session Cookie.001
• Exploitation of Remote ServicesAML.T0122

AML.TA0009ATT&CK TA0009

• AI Artifact CollectionAML.T0035
• Data from Information RepositoriesAML.T0036
• Data from Local SystemAML.T0037
• Data from AI ServicesAML.T0085
  • RAG Databases.000
  • AI Agent Tools.001
• Automated CollectionAML.T0126
• Data StagedAML.T0127

AML.TA0014ATT&CK TA0011

• Cyber Communication ChannelAML.T0072
• AI Service APIAML.T0096
• AI AgentAML.T0108
• AI Service Web InterfaceAML.T0114
• AI Artifact RepositoryAML.T0120

AML.TA0010ATT&CK TA0010

• Exfiltration via AI Inference APIAML.T0024
  • Infer Training Data Membership.000
  • Invert AI Model.001
  • Extract AI Model.002
• Exfiltration via Cyber MeansAML.T0025
• Extract LLM System PromptAML.T0056
• LLM Data LeakageAML.T0057
• LLM Response RenderingAML.T0077
• Exfiltration via AI Agent Tool InvocationAML.T0086

AML.TA0011ATT&CK TA0040

• Evade AI ModelAML.T0015
• Denial of AI ServiceAML.T0029
• Erode AI Model IntegrityAML.T0031
• Cost HarvestingAML.T0034
  • Excessive Queries.000
  • Resource-Intensive Queries.001
  • Agentic Resource Consumption.002
• Spamming AI System with Chaff DataAML.T0046
• External HarmsAML.T0048
  • Financial Harm.000
  • Reputational Harm.001
  • Societal Harm.002
  • User Harm.003
  • AI Intellectual Property Theft.004
• Erode Dataset IntegrityAML.T0059
• Data Destruction via AI Agent Tool InvocationAML.T0101
• Machine CompromiseAML.T0112
  • Local AI Agent.000
  • AI Artifacts.001
• AI Agent Response BiasingAML.T0130