Initial Access Privilege Escalation Lateral Movement AML.T0012

Valid Accounts

Description

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access.

Credentials may take the form of usernames and passwords of individual user accounts or API keys that provide access to various AI resources and services.

Compromised credentials may provide access to additional AI artifacts and allow the adversary to perform Discover AI Artifacts.

Compromised credentials may also grant an adversary increased privileges such as write access to AI artifacts used during development or production.

ATLAS ID: AML.T0012
Maturity: RealizedUsed by real adversaries against AI systems in the wild.
Platforms: Enterprise

Mitigations

AML.M0005Control Access to AI Models and Data at Rest
Restrict model registries and training data to approved identities so compromised accounts expose only explicitly authorized AI assets.
AML.M0019Control Access to AI Models and Data in Production
Authenticate production AI endpoints and monitor model queries for misuse of otherwise valid credentials.

Case studies that use it

Related ATT&CK technique

ATLAS adapts this technique from MITRE ATT&CK Enterprise.

T1078Valid Accounts

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.