ATLAS to ATT&CK Parent Mapper

Both techniques describe adversaries mining publicly available technical sources to gather intelligence before an attack; ATLAS AML.T0000 narrows the ATT&CK parent T1596 to AI-specific artifacts such as academic papers, model cards, and public repositories that reveal a victim's ML architecture and data pipeline. The formal cross-reference exists because the tradecraft is identical—passive open-source research—with the distinction being the AI-focused intent (e.g., identifying open-source base models to build a proxy model).

This ATLAS technique describes an adversary researching known vulnerabilities in a targeted class of AI models by reviewing academic papers and existing attack implementations. The closest ATT&CK analogue is Reconnaissance-phase vulnerability research; while T1595.002 emphasizes active scanning, the shared adversary goal is identifying exploitable weaknesses before an attack. A conceptual (not formal) match applies because ATLAS focuses on AI-specific vulnerability literature and adversarial ML attack code rather than traditional software CVEs.

This ATLAS technique is a direct extension of ATT&CK T1594; both describe adversaries mining a victim's own public websites for targeting information without any intrusion. The ATLAS variant narrows the focus to details about AI-enabled products, such as model descriptions, service capabilities, and staff who build or operate ML systems. That AI-specific intelligence is later used to craft adversarial ML attacks or manual model manipulation.

This ATLAS technique describes adversaries querying public app stores (Google Play, iOS App Store, Microsoft Store) to find applications with embedded AI/ML components as a targeting step. ATT&CK's T1593 covers the analogous behavior of mining publicly available online resources to gather information about a target before an attack. The adversary goal—passive reconnaissance against openly accessible repositories to identify targets—is closely aligned, with the AI-specific twist being the focus on AI-enabled apps.

ATLAS AML.T0006 is a direct AI-focused extension of ATT&CK T1595: both describe an adversary directly interacting with a victim's infrastructure to gather targeting information, as opposed to passive collection. The ATLAS variant adds AI-specific probing behaviors, such as port and service scans that reveal AI DevOps tooling or hosted AI services, enumeration of public AI chat agents (e.g., Copilot Studio Hunter), and sending emails to inspect replies for signs an AI agent manages the inbox. The core action—active, direct scanning of the victim—is identical to the ATT&CK technique.

Both techniques center on an adversary identifying and gathering information from data repositories that a system relies on. In ATT&CK T1213, attackers discover and collect from knowledge stores (SharePoint, Confluence, wikis); here the adversary is specifically reconnoitering the external data sources that feed a RAG pipeline so those repositories can later be poisoned. The goal of locating the authoritative data store the target depends on is the same, though the ATLAS technique is reconnaissance for a downstream poisoning attack rather than direct data theft.

ATLAS AML.T0087 is a direct adoption of ATT&CK T1589 into the AI threat context, sharing the same name and a formal cross-reference. Both cover collecting personal data, email addresses, credentials, and MFA configurations about victims to enable targeting. The AI-specific twist is that harvested identity data (photos, voice, personal details) feeds deepfake creation and convincing impersonation, but the underlying reconnaissance activity is identical to the ATT&CK technique.

This ATLAS technique is a direct, formally cross-referenced counterpart to ATT&CK T1593, which covers adversaries mining public websites, social media, and victim-owned domains for targeting intelligence. The ATLAS variant narrows the same reconnaissance behavior toward identifying AI/ML software platforms, services, and public-facing model endpoints that a victim exposes, so an analyst can treat detection and mitigation approaches for T1593 as applicable. The primary distinction is the intended follow-on: the harvested information feeds AI-specific exploitation such as prompt injection against public-facing applications rather than generic exploitation.

Both techniques involve an adversary mining publicly accessible sources to gather intelligence about a target before an attack. ATT&CK's T1593 covers searching public websites, repositories, and services for useful information, which closely parallels ATLAS's focus on locating publicly hosted AI artifacts such as model files, training data, and configurations. The AI-specific angle is that the harvested artifacts reveal the victim's ML task, architecture, and pipeline rather than general IT infrastructure details.

This ATLAS technique is a direct AI-focused extension of ATT&CK T1588, where adversaries acquire tooling before an operation. The distinction is content: ATLAS covers purpose-built adversarial ML attack implementations (e.g. libraries for crafting evasion or poisoning inputs) alongside generic repurposed software, whereas T1588 broadly covers malware, exploits, tools, and certificates. Both cover the pre-attack acquisition and customization of offensive capabilities rather than their deployment.

Both techniques describe adversaries building their own tooling and infrastructure ahead of an attack rather than acquiring it from third parties. The ATLAS version narrows this to AI-focused operations—such as standing up websites seeded with adversarial content to poison training data or crafting Jupyter notebooks containing obfuscated exfiltration code—but the underlying behavior (identifying requirements, building, and deploying capabilities) is identical to ATT&CK T1587. The formal cross-reference confirms this is the same technique applied to the AI attack surface.

This ATLAS technique mirrors ATT&CK's Acquire Infrastructure (T1583) almost directly: adversaries buy, lease, or rent servers, domains, and third-party web services to stage and launch operations. The ATLAS variant extends the concept with AI-specific physical countermeasures (printed adversarial patterns, wearables, disguises) meant to degrade sensors or ML components, but the core goal—provisioning operational resources ahead of an attack—is identical to the ATT&CK technique. Because the adversary objective and most sub-methods align cleanly, this is a strong conceptual match rather than an AI-unique behavior.

Publishing a poisoned dataset to a public repository so a victim ingests it during model development is conceptually analogous to compromising the software supply chain, where an adversary seeds malicious content into a widely-consumed dependency and waits for downstream targets to pull it in. The ATLAS technique replaces tampered code/binaries with tampered training data, but the adversary goal is the same: gain a foothold in the victim's pipeline via a trusted upstream artifact. It is not a formal match because ATT&CK's T1195.002 scopes to software components rather than ML training data, hence the mapping is conceptual.

Poisoning training data manipulates the statistical relationships an AI model learns during training, embedding a latent backdoor or bias that only surfaces when specific trigger inputs appear at inference time. Traditional ATT&CK data-manipulation techniques (e.g. T1565 Data Manipulation) target the integrity of stored or transmitted business data to cause immediate operational impact, whereas this technique corrupts the learning process itself so the compromised behavior is baked into model weights and evades conventional file-integrity or content-inspection controls. Because the effect is mediated through the training pipeline and activated later by crafted samples, there is no close ATT&CK analogue.

This ATLAS technique is a direct adoption of ATT&CK T1585: adversaries register accounts with third-party services to build the infrastructure needed for an attack rather than to breach the target directly. In the AI context the created accounts specifically unlock resources for AI Attack Staging — for example signing up for ML platforms, model hosting hubs, or cloud compute to train proxy models or craft adversarial inputs — and can also enable victim impersonation. The mapping is one-to-one because the adversary behavior (proactively creating attacker-controlled accounts) is identical; only the downstream objective is AI-flavored.

In this ATLAS technique the adversary uploads a backdoored or trojanized ML model to a public model registry (e.g., Hugging Face) or code repository so that a victim will download and integrate it. This mirrors ATT&CK's Stage Capabilities, where an adversary places malicious tooling on infrastructure they control or on third-party platforms to await victim retrieval; the model artifact is the staged malicious payload rather than a traditional malware binary. Both share the goal of pre-positioning a compromised asset for later delivery through the supply chain.

The adversary registers a real, controlled entity (most commonly a malicious software package under a name the LLM invented, a.k.a. "slopsquatting") so that a victim who trusts the LLM's output pulls the attacker's artifact into their environment. This mirrors ATT&CK's software supply chain compromise, where trusted distribution channels like package registries are poisoned to gain code execution, except here the trust vector is an LLM hallucination rather than a legitimate upstream dependency. The goal (deliver adversary-controlled code/content via a trusted-seeming source) is the same, making it a close conceptual analogue.

This technique involves iteratively engineering natural-language prompts to defeat a generative AI model's built-in safety and alignment guardrails so it executes attacker-supplied instructions. There is no meaningful ATT&CK parallel because ATT&CK's defense-evasion techniques target operating systems, logging, and security tooling via code, configuration, or process manipulation, whereas prompt crafting exploits the semantic behavior of a language model itself. The adversary's manipulation surface is the model's input text and its learned instruction-following behavior, which has no analogue in traditional enterprise attack surfaces.

This technique involves authoring text specifically engineered to be surfaced by a RAG system's similarity search and then influence the human reading the model's response, exploiting the user's trust in the AI assistant. ATT&CK has no equivalent: its persuasion-adjacent techniques (e.g. Phishing, Spearphishing) target humans directly through delivery channels, whereas here the influence is mediated by a machine-learning retrieval pipeline that decides which content reaches the user. The reliance on vector embeddings, retrieval ranking, and LLM-generated output as the attack surface is specific to AI systems and has no ATT&CK parallel.

Both techniques describe adversaries placing pre-developed or acquired capabilities onto controlled infrastructure so they are ready for use during an operation, and ATLAS AML.T0079 carries a formal cross-reference to ATT&CK T1608. The distinction is the payload: in the AI context the staged assets are AI artifacts such as poisoned datasets, backdoored models, or trojanized ML packages uploaded to model registries (Hugging Face), container registries, or code repositories (GitHub), rather than conventional malware or phishing pages. The intent, hosting a ready-to-deliver capability on adversary-controlled or compromised infrastructure, is identical.

Publishing a poisoned AI agent tool to public registries (npm, GitHub, MCP/tool hubs) mirrors the classic supply chain attack of planting malicious code in a dependency that victims voluntarily install. The ATT&CK analogue captures the same adversary goal—gaining a foothold by getting the target to consume an attacker-controlled component from a trusted-looking source. The mapping is conceptual rather than formal because the payload here is a natural-language prompt injection that hijacks an LLM agent's behavior rather than executable malware, an AI-specific twist ATT&CK does not model.

ATT&CK T1195 covers adversaries manipulating products or delivery mechanisms before they reach the victim, which is the same adversary goal as AML.T0010: achieving initial access by tampering with trusted upstream components. The AI variant extends this concept to ML-specific artifacts—training data and annotations, pretrained models, and AI software/hardware stacks (e.g., a backdoored model on a public hub)—which have no dedicated ATT&CK sub-technique, making this a close conceptual analogue rather than a formal cross-reference.

This ATLAS technique is a direct application of ATT&CK T1078, where adversaries reuse stolen legitimate credentials rather than exploiting vulnerabilities to gain entry. In the AI context the abused credentials specifically unlock ML resources such as API keys for model endpoints, training data stores, and model registries, letting the attacker blend in with normal authenticated activity. Both techniques share the same detection challenge: the access appears legitimate, so anomaly detection on account behavior is required rather than signature-based alerting.

Evading an AI model means feeding it crafted inputs (adversarial perturbations or deepfakes) that cause the model to misclassify while a human would still perceive the true content — the attack exploits the learned decision boundary of a machine learning model itself, which has no equivalent in ATT&CK's enterprise techniques. While ATT&CK covers evading conventional defenses (e.g. T1027 Obfuscated Files, T1562 Impair Defenses), those target signature/rule-based or configuration-based controls, not the statistical inference of an ML classifier, so no technique shares the same underlying mechanism. The closest conceptual sibling is Defense Evasion as a goal, but the AI-specific manipulation of model inference has no meaningful ATT&CK parallel.

This ATLAS technique is a direct one-to-one carryover of ATT&CK T1190, sharing the same technique name and formal cross-reference. In an AI context, the Internet-facing application is often an ML inference API, model-serving endpoint, or an MLOps dashboard whose software vulnerabilities (bugs, misconfigurations, or design flaws) grant adversaries an initial foothold into the ML environment. The underlying exploitation mechanics are identical to conventional application exploitation; only the exposed asset differs.

ATLAS AML.T0052 is a direct extension of ATT&CK T1566: both describe adversaries using electronically delivered social engineering (email, messaging, spearphishing) to gain access to victim systems. The ATLAS variant emphasizes how generative AI—LLM-authored text, visual deepfakes, and audio deepfakes—lets attackers scale and personalize these lures far beyond hand-crafted campaigns. The core technique and detections (link/attachment analysis, sender reputation, user reporting) are identical; the AI angle changes the volume and believability of the messages, not the delivery mechanism.

This ATLAS technique is the AI-specific extension of ATT&CK T1189: both describe an adversary compromising a target when a user (or an AI agent acting for the user) simply visits a website during normal browsing. The formal cross-reference exists because the delivery mechanism is identical to classic drive-by compromise; the difference is the payload, which here is an LLM prompt injection embedded in web content rather than browser-exploiting code. When an AI agent fetches that page, the malicious instructions alter the model's behavior, giving the adversary an initial foothold into the AI system.

This ATLAS technique involves planting malicious prompt content into a public-facing application (email, shared drives, ticketing systems) so it is later ingested and acted upon by an AI, which closely parallels ATT&CK's Content Injection where an adversary inserts malicious content into a channel that a victim system later consumes. Both achieve initial access and persistence indirectly by staging attacker-controlled content that triggers execution when the target processes it, rather than through a direct exploit. The AI-specific twist is that the "payload" is natural-language prompt instructions interpreted by an LLM or RAG pipeline rather than traditional malicious code, so the mapping is conceptual rather than formal.

Like External Remote Services, this technique involves an adversary using a legitimate, externally-exposed interface (the model inference API) to gain access to a target system without exploiting a vulnerability. The parallel is conceptual rather than formal: instead of remote access services like VPNs or RDP, the adversary leverages the ML model's public inference endpoint as the entry point for reconnaissance, attack staging, or impact. The adversary goal — obtaining legitimate access to a service to enable follow-on actions — is closely analogous.

This technique describes an adversary consuming a legitimate AI-powered product or service specifically to reach and study the AI model embedded within it, rather than to exploit a host, network, or credential. ATT&CK's access techniques target operating systems, applications, and infrastructure, so none capture the goal of gaining indirect access to an AI model and harvesting its inferences, logs, or metadata as a reconnaissance or staging step. The adversary goal here is model-specific reconnaissance through sanctioned usage, which has no meaningful enterprise ATT&CK parallel.

This technique describes an adversary manipulating the physical world where an ML model collects its sensor data (e.g. placing stickers on a road sign to fool an autonomous vehicle, or altering a scene before a camera captures it) to reproduce digital adversarial attacks against real-world data pipelines. ATT&CK is scoped to digital enterprise, cloud, and network intrusion behavior and has no technique covering manipulation of the physical data-collection environment as an attack vector against a model. The closest ATT&CK concepts (physical access for hardware implants) target IT devices, not the sensory input a model perceives, so no meaningful parallel exists.

Full AI Model Access describes an adversary obtaining complete "white-box" knowledge of a model's architecture, weights/parameters, and class ontology, which uniquely enables ML-specific follow-on attacks like crafting adversarial examples offline. Traditional ATT&CK has no equivalent because its access and collection techniques (e.g., credential theft, data staging) target files, hosts, and accounts rather than the internal mathematical structure of a trained model. The value here is the ML knowledge gained, not the mechanism of access, so no ATT&CK technique captures the same adversary goal.

This ATLAS technique is a direct AI-context specialization of ATT&CK T1204, which covers an adversary relying on a user to run malicious code rather than executing it themselves. In the AI setting, the "content" the user is tricked into running is frequently a compromised model artifact, notebook, or dependency pulled from a poisoned AI supply chain (AML.T0010), but the underlying mechanism—social engineering a human into triggering execution—is identical. The formal cross-reference exists because both describe the same execution vector triggered by user action.

AML.T0050 is a direct port of ATT&CK T1059 into the AI/ML context, sharing the same ID root and formal cross-reference. Both cover adversaries abusing built-in interpreters such as Unix shell, PowerShell, Windows Command Shell, and cross-platform runtimes like Python to run arbitrary commands, scripts, or binaries. In an ML setting this often means executing Python within a notebook, training pipeline, or model-serving container to run attacker-controlled code.

Prompt injection exploits the fact that an LLM cannot reliably distinguish trusted developer instructions from untrusted user- or data-supplied text, causing it to override its original directives. This is fundamentally an AI-specific weakness with no meaningful ATT&CK parallel: unlike traditional injection (e.g. Command or SQL injection, T1059/T1190) which crosses a defined code/data boundary in software, prompt injection abuses the model's natural-language reasoning layer where instructions and data share the same channel. There is no equivalent adversary technique in ATT&CK's software-focused matrices.

When an AI agent is wired to a code or command interpreter tool, an adversary who controls the agent's inputs can coerce it into running arbitrary instructions—functionally the same adversary goal as T1059, where an attacker abuses an interpreter to execute commands. The AI agent acts as an intermediary execution proxy: the adversary supplies natural-language prompts and the agent translates them into API calls, shell commands, or scripts on integrated systems. This is a conceptual rather than formal match because the abuse vector (prompt-driven tool invocation through an LLM) has no dedicated ATT&CK reference, but the execution and privilege-escalation outcome closely parallels interpreter abuse.

AI Agent Clickbait is the AI-agent analogue of User Execution: instead of tricking a human into clicking a malicious link or running attacker-supplied code, the adversary crafts deceptive web content that manipulates an AI browsing agent into performing that action on the user's behalf. Both rely on social-engineering-style deception targeting a trusted actor whose actions carry the user's privileges, and both can culminate in malicious code being copied and executed on the host. The mapping is conceptual because ATT&CK T1204 assumes a human decision-maker, whereas here the exploited "user" is an autonomous AI agent interpreting UI cues and prompt-like text.

Deploying an AI agent is fundamentally an execution technique: the adversary launches an autonomous process in the victim environment that runs commands and interacts with tools and services on their behalf, analogous to how an attacker abuses a management interface to execute code within existing infrastructure. The closest ATT&CK analogue is the broader Execution tactic (e.g., T1609/T1059) where a trusted administrative or runtime service is co-opted to run adversary-directed actions, though ATT&CK has no concept of a goal-driven autonomous agent that plans its own steps. The mapping is conceptual because the adversary goal (running actions in-environment) matches, but the autonomous, tool-wielding LLM agent is an AI-specific execution vehicle.

Directly altering a model's stored weights or architecture is conceptually analogous to Stored Data Manipulation, where an adversary tampers with data at rest to influence downstream outcomes and achieve a persistent effect. In both cases the attacker modifies trusted artifacts on disk (here, the serialized model file) rather than intercepting them in transit. The embedding-malware variant also parallels ATT&CK T1554 (Compromise Host Software Binary), since a poisoned model file can execute code when deserialized/loaded.

This technique relies on manipulating an LLM's natural-language generation so that a malicious prompt reproduces itself in the model's output, letting it spread to downstream LLMs and persist across interactions — behavior that only exists because of how generative models process and emit text. While it superficially resembles self-propagating malware or worms, ATT&CK propagation techniques assume executable code and OS-level replication mechanisms, whereas here the "payload" is natural-language instructions interpreted by a model, so no ATT&CK technique captures the same adversary goal or mechanism. It is therefore genuinely AI-unique with no meaningful ATT&CK parallel.

RAG Poisoning exploits the retrieval-augmented generation pipeline by planting malicious documents in a knowledge source (vector store, document index, or web content) that the LLM later retrieves and treats as trusted context, enabling indirect prompt injection or misinformation delivery. While conceptually adjacent to data manipulation techniques like ATT&CK T1565 (Data Manipulation), that technique targets stored/transmitted operational data to disrupt business processes, whereas RAG Poisoning specifically weaponizes the semantic retrieval step to hijack an AI model's generated output for a future user query. The reliance on embedding-based search surfacing and prompt injection semantics has no meaningful equivalent in the ATT&CK enterprise matrix, making it AI-unique.

This technique manipulates the contextual inputs (persistent memory or conversation thread history) that an LLM-based agent uses to generate responses and take actions, causing durable behavioral changes without ever touching the model weights or the underlying host. ATT&CK's persistence and defense-evasion techniques target operating systems, accounts, and binaries rather than the semantic reasoning context of an AI model, so there is no meaningful parallel. The attack surface—an LLM's mutable context window and agent memory store—is unique to generative AI systems and has no equivalent primitive in the enterprise ATT&CK matrix.

Modifying an AI agent's persistent configuration files is conceptually analogous to tampering with configuration-driven execution mechanisms in ATT&CK, where an attacker alters stored settings so malicious behavior automatically recurs whenever the software runs. Like T1546, the change persists beyond a single session and affects every agent instance that loads the shared config, achieving both persistence and defense evasion (e.g., disabling human-in-the-loop safeguards). The AI-specific payloads—system prompt injection, poisoned knowledge sources, redirected tools—have no exact ATT&CK equivalent, but the goal of embedding durable malicious logic in config maps closely to this technique.

The adversary plants malicious or misleading content in data repositories (documents, files, knowledge stores) that an AI agent's tools will later retrieve, which closely parallels ATT&CK's Stored Data Manipulation where an attacker alters at-rest data to influence downstream decisions or outcomes. The AI-specific twist is that the poisoned content can carry indirect prompt injections that hijack the agent's behavior, but the core adversary goal—corrupting stored data that a system consumes—is the same. It is a conceptual rather than formal match because ATT&CK has no reference tailored to AI agent tool retrieval.

Both techniques achieve persistence by modifying legitimate, already-trusted software so that malicious behavior executes whenever the software is invoked, without deploying new artifacts that would draw suspicion. In ATT&CK T1554 an adversary alters a trusted binary or utility on the host; in this ATLAS technique the adversary alters a tool the AI agent trusts and repeatedly calls (built-in or MCP-connected), so poisoned logic runs on every agent invocation. The AI-agent tooling layer is the specific twist, but the persistence-through-trusted-component mechanism is a close direct analogue.

LLM Jailbreak is specific to AI/ML systems: it targets the safety alignment and guardrails that are a property of large language models, using adversarial prompts or weight/safety-mechanism modification to make the model produce outputs it is designed to withhold. Traditional ATT&CK Defense Evasion techniques (e.g., Impair Defenses, T1562) target security controls like EDR, logging, or firewalls on hosts and networks, not the learned behavioral constraints of a model, so no meaningful ATT&CK analogue exists. The adversary's "control" being bypassed is the model's own alignment, a concept with no counterpart in the ATT&CK matrix.

This ATLAS technique is a direct formal cross-reference to ATT&CK T1611, sharing the same name and core behavior: breaking out of a container or sandbox to reach the underlying host. ATLAS extends the concept to AI-specific vectors, such as tampering with an AI agent's configuration to disable safety checks or user confirmations so that agent-invoked tools execute on the host instead of the isolated sandbox. Both describe the same isolation-boundary violation, so the classic ATT&CK detections for container escape apply directly.

This technique manipulates the generative output of an LLM—its wording, links, citations, and suggested actions—so that malicious responses appear legitimate to the end user, an attack surface that exists only because the model produces natural-language content consumed as trusted advice. ATT&CK's defense-evasion and impersonation techniques target files, processes, credentials, and network artifacts rather than the semantic content of a model's generated text, so no technique captures the goal of falsifying a language model's response components. The closest conceptual cousin (T1656 Impersonation) still concerns adversary-controlled communications, not the corruption of a legitimate model's own trusted output, so this remains AI-unique.

This technique hides or encodes malicious prompt-injection content (via base64/rot13 encoding, invisible text, hidden HTML, or data steganography in image pixels and file metadata) to evade LLM guardrails and human review, which is the same adversary goal as ATT&CK's Obfuscated Files or Information: making malicious payloads difficult for detection mechanisms and humans to identify. The mapping is conceptual rather than formal because T1027 addresses obfuscation of files/scripts to evade endpoint and file-based defenses, whereas AML.T0068 targets the semantic content parsed by an LLM and its safety filters. The obfuscation methods (encoding, hidden fields, steganography) are directly analogous even though the detection target differs.

This technique abuses the retrieval-augmented generation (RAG) pipeline by embedding fake "documents" inside legitimate ingested data so the LLM later treats attacker-controlled text as an authoritative retrieved result. There is no close ATT&CK parallel because the attack exploits how an LLM interprets and trusts natural-language content within a RAG vector store, a behavior that has no equivalent in traditional host, network, or application exploitation. Conventional data-poisoning or content-injection ATT&CK techniques target executable logic or structured data, not the semantic trust an LLM places in retrieved text.

ATLAS AML.T0073 and ATT&CK T1656 describe the same core behavior: an adversary poses as a trusted person or organization—an executive, colleague, or third-party vendor—to manipulate a target into taking an action. The ATLAS variant emphasizes that LLMs can be used to generate more convincing impersonation content (e.g., Spearphishing via Social Engineering LLM) and that the trust gained may be turned against AI DevOps assets like model repositories and container registries. The formal cross-reference confirms these are equivalent techniques.

ATLAS AML.T0074 and ATT&CK T1036 describe the identical behavior of manipulating an artifact's name, location, or metadata to appear legitimate and evade detection. In an AI context this maps directly: an adversary might rename a poisoned model file, a malicious pickle payload, or a rogue inference service to mimic a trusted asset. The formal cross-reference reflects that no AI-specific adaptation is needed; the classic masquerading concept applies unchanged.

Deliberately corrupting a model file so a scanner cannot fully deserialize it is a form of manipulating file contents to defeat static analysis, which is the core intent of T1027. The adversary is not hiding data through encoding but is instead damaging the file structure so automated defensive tooling fails to parse and inspect the embedded malicious payload, while the payload still executes during the partial deserialization. This maps to the defense-evasion goal of making malicious content unreadable to scanners, even though the specific mechanism (breaking model deserialization) is AI/ML-specific.

This technique maps conceptually to Indicator Removal (T1070) because the adversary deletes or edits chat messages and creates new threads specifically to erase evidence of their intrusion, mirroring the ATT&CK goal of removing artifacts that would reveal malicious activity. The parallel is close: in ATT&CK an attacker clears logs or command history, while here the attacker clears the LLM conversation history that serves as the equivalent activity record. The distinction is that the "log" being tampered with is a conversational chat transcript rather than a system event log.

This technique exploits the conversational, multi-turn nature of large language models by embedding malicious instructions that trigger only on a future event (a keyword or the next user interaction), thereby escaping the detection window that many prompt-injection guardrails apply to the current turn. There is no meaningful ATT&CK parallel because ATT&CK's evasion techniques address binaries, processes, logs, and OS-level controls rather than the deferred interpretation of natural-language instructions by a model. The core mechanism—time-shifting instruction execution across dialogue turns to sidestep AI-specific injection defenses—is unique to LLM and AI agent architectures.

This ATLAS technique is a direct inheritance of ATT&CK T1497, sharing the same name and adversary goal: detecting analysis environments and altering malware behavior to avoid discovery. Both cover the same detection methods (checking for VM registry keys like VMware/VBOX/QEMU, security tools such as Sysinternals or Wireshark, and environment artifacts). In the ATLAS context, the same evasion logic is applied by payloads targeting or riding alongside ML system compromises, but the underlying technique is unchanged from the ATT&CK original.

This ATLAS technique is a direct one-to-one adoption of ATT&CK T1211, describing how adversaries exploit programming errors in software, services, or the OS kernel to bypass or disable security controls. In the AI context, the "defensive security software" may include ML-based detection systems, model input validators, or guardrail services, but the underlying exploitation mechanism is identical to the classic ATT&CK technique. The formal cross-reference in the ATLAS data confirms they represent the same behavior.

This technique is the AI-specific expression of a software supply chain compromise: an adversary distributes a trusted component (here an AI model, dataset, or agent tool) and later pushes a malicious update once it is widely adopted. The core adversary goal—delivering malicious code/artifacts through a trusted distribution channel to reach downstream victims—maps directly to ATT&CK's Compromise Software Supply Chain. The "rug pull" timing element (building trust first, then weaponizing an update) is a behavioral nuance not captured in ATT&CK, but the mechanism and outcome are the same.

This technique builds credible-looking trust signals (aged developer accounts, downloads, GitHub stars, forks) to make malicious AI supply chain components appear legitimate, which closely parallels ATT&CK's Establish Accounts where adversaries create and cultivate personas/accounts to support later operations. The ATLAS variant is specialized: the reputation is inflated specifically around AI artifacts (models, datasets, packages, MCP servers) to drive adoption before a rug pull, but the core adversary goal of manufacturing legitimacy for staged infrastructure is the same. Related ATT&CK concepts include Compromise Accounts (T1586) when established third-party accounts are hijacked instead of built.

ATLAS AML.T0055 is a direct one-to-one adoption of ATT&CK T1552, applied to systems that host ML workloads. In both, adversaries harvest credentials left insecurely in plaintext files, bash history, environment variables, registry entries, or private key files. In an AI context these credentials frequently unlock model registries, training data stores, API keys for inference services, and cloud ML platforms.

Both techniques share the goal of harvesting credentials that were carelessly stored in plaintext within accessible files or documents. In ATT&CK T1552, an attacker searches file systems, config files, and repositories for exposed secrets; here the RAG database serves as the searchable store, and the adversary uses LLM prompts to coax the AI agent into retrieving credentials that were inadvertently ingested from internal documents. The novelty is the retrieval vector (natural-language queries to an AI agent) rather than the adversary goal, so this is a conceptual rather than formal match.

This ATLAS technique describes harvesting API keys, tokens, and connection strings that AI agents store in configuration files to authenticate to external tools and services. That maps directly to ATT&CK T1552.001, where adversaries search local file systems and application config files for plaintext credentials. The adversary goal (obtaining valid credentials for downstream systems) and method (reading unprotected config artifacts) are the same; the AI agent is simply the specific application whose config is being looted.

This ATLAS technique is a direct, one-to-one adoption of ATT&CK T1003: adversaries harvest credentials (hashes, cleartext passwords, tokens, or authentication keys) from OS credential stores, memory such as LSASS, or caches on a compromised host. The AI-specific angle is only in how the stolen credentials are used afterward — to reach AI services, model registries, or DevOps tooling — while the dumping mechanics are identical to the enterprise technique.

This technique's goal—harvesting credentials from data stores the agent can reach (SharePoint, GitHub, Slack, note apps)—directly parallels ATT&CK's Unsecured Credentials, where adversaries search accessible files, repositories, and application data for exposed secrets. The AI-specific twist is that the AI agent's connected tools become the search surface and the agent itself performs the collection, but the underlying adversary objective and target (credentials scattered across enterprise data sources) is the same. It is conceptual rather than formal because ATLAS provides no official ATT&CK cross-reference and the agent-mediated access is a novel delivery mechanism.

ATLAS AML.T0106 carries a formal cross-reference to ATT&CK T1211, where an adversary abuses a programming flaw in a service, application, OS, or kernel to run their own code. In the ATLAS credential-access context this exploitation is aimed at harvesting credentials (API keys, service account tokens, model registry secrets) rather than evading defenses, but the underlying mechanism—turning a software vulnerability into arbitrary code execution—is identical. Note that ATT&CK filed T1211 under Defense Evasion while ATLAS places this behavior under its Credential Access tactic (AML.TA0013).

This technique targets the semantic output space of an ML model—the set of labels, classes, or object types the model can produce—which is a concept with no equivalent in traditional ATT&CK, where discovery focuses on hosts, accounts, network shares, and system configuration. While ATT&CK discovery techniques enumerate infrastructure artifacts, mapping a model's ontology requires either interpreting ML-specific documentation/config or issuing repeated inference queries to enumerate outputs, both of which are meaningful only against an AI system. No ATT&CK technique captures the adversary goal of understanding a model's predictive vocabulary.

This technique involves fingerprinting the architecture or family of a machine learning model (e.g., identifying it as a transformer-based LLM, a CNN, or a specific known base model) by reading published documentation or by probing the model with crafted inputs and analyzing the outputs. ATT&CK's discovery techniques target operating systems, software inventories, network services, and user accounts, but none address characterizing the internal structure or lineage of an ML model, so no meaningful ATT&CK analogue exists. The adversary's goal here is entirely specific to AI/ML systems.

This ATLAS technique describes an adversary who already has access to a victim environment enumerating internal ML assets — model files, training/testing datasets, container registries, software repositories, and model zoos — to plan follow-on collection, exfiltration, or disruption. ATT&CK's File and Directory Discovery (T1083) is the closest analogue because both cover post-compromise reconnaissance of on-system artifacts to locate high-value targets; the ATLAS variant simply narrows the search to AI/ML-specific files and infrastructure. A SOC analyst can treat it as ordinary internal discovery activity where the objects of interest happen to be ML artifacts.

This technique relies on a property unique to generative AI: LLMs fabricate plausible-but-nonexistent entities (package names, URLs, commands) when responding to prompts, and adversaries systematically probe for these fabrications to find reusable attack surface. ATT&CK's reconnaissance and resource-development techniques assume the adversary is discovering real assets that already exist; here the adversary is discovering non-existent artifacts that victims will nonetheless try to use because a model recommended them. There is no ATT&CK technique whose goal is enumerating a model's confidently-wrong outputs, so no meaningful conceptual parallel applies.

Both techniques share the adversary goal of enumerating system-exposed information that reveals internal details useful for further attack planning. In ATT&CK T1082, an adversary gathers system configuration data; here the adversary harvests unintended model outputs (e.g. class scores or confidence values) leaked in logs or API responses that expose the model's internal decision behavior. There is no formal ATT&CK cross-reference, but the discovery-of-exposed-information objective makes it a close conceptual analogue.

Both techniques share the adversary goal of enumerating a target system's configuration and operating parameters to inform later stages of an attack. In classic ATT&CK T1082, an adversary queries an OS for hardware, software, and configuration details; here the "system" is an LLM and the adversary probes it (or reads its config) to recover the system prompt, control tokens, and available functionality. The analogue is close because the intent—reconnaissance of how the target is configured—is identical, even though the enumeration surface is a language model rather than an operating system.

Both techniques describe an adversary enumerating the cloud services enabled in a compromised environment (PaaS, IaaS, SaaS) to understand available capabilities, security controls, and potential targets. The ATLAS variant extends the same behavior to AI-as-a-Service offerings such as AI inference, generative AI, and agentic AI endpoints, but the underlying tradecraft—querying provider APIs like Microsoft Graph or Azure Resource Manager—is identical. The formal ATT&CK cross-reference to T1526 confirms this is the same discovery activity applied to an AI-relevant service inventory.

Both techniques share the goal of enumerating a target's configuration to inform follow-on targeting; in ATT&CK T1082 covers discovering system-level details, and this ATLAS technique applies that same reconnaissance goal to an AI agent's configuration (its available tools, services, and permissions). The key distinction is the discovery vector: rather than OS commands, the adversary may simply prompt the agent conversationally (e.g. "What tools do you have access to?") or read agent config files/dashboards. T1236 (Cloud Service Discovery) or T1526 could also partially apply where the agent's tools are cloud services.

This ATLAS technique is a direct application of ATT&CK T1057 Process Discovery, using the same enumeration methods (Tasklist, Get-Process, reading /proc, ps) to list running processes. The AI-specific angle is that the adversary examines the process list specifically to fingerprint AI/ML software stacks (e.g., training frameworks, inference servers, model-serving daemons) rather than general system reconnaissance. The mechanics and detection are identical to the parent ATT&CK technique.

AML.T0091 is a direct AI-domain adoption of ATT&CK T1550: both describe abusing credential artifacts like password hashes, Kerberos tickets, and application access tokens to authenticate without the underlying password, bypassing normal access controls. The AI-specific twist is that ML services (e.g., inference endpoints) routinely use API keys and access tokens as the standard query mechanism, so a stolen token grants immediate legitimate-looking access to the model. The technique and its ATT&CK parent are functionally identical, differing only in the target being an AI service.

Both techniques share the same adversary goal under the Collection tactic: gathering high-value data from a compromised system to stage a later attack or exfiltration. ATLAS AI Artifact Collection is a specialization of ATT&CK's Data from Local System, where the sought-after files are ML-specific assets—model weights, training/validation datasets, and inference telemetry—rather than generic documents or credentials. No formal ATT&CK cross-reference exists, but the collection behavior is a close analogue.

This ATLAS technique is a direct one-to-one mapping to ATT&CK T1213, which describes adversaries mining collaboration and storage platforms like SharePoint, Confluence, and SQL databases for useful information. In the AI context, these same repositories often hold ML-specific assets such as model documentation, training data locations, API keys, and architecture details that help an adversary advance toward compromising an ML system. The formal cross-reference exists because the underlying tactic (Collection) and target (information repositories) are identical between the two frameworks.

AML.T0037 is a direct ATLAS restatement of ATT&CK T1005: both describe an adversary searching local file systems, configuration files, and databases on a compromised host to locate sensitive data before exfiltration. In the AI context this means harvesting the same on-host artifacts (SSH keys, credentials, fingerprinting data) that happen to sit alongside ML assets such as model files, training datasets, and API tokens. The techniques are functionally identical, which is why ATLAS carries a formal cross-reference to T1005.

Both techniques describe an adversary harvesting proprietary or sensitive data from a centralized service that aggregates organizational information. In ATT&CK T1213 the adversary mines repositories like Confluence, SharePoint, or databases; in ATLAS T0085 the AI service (e.g., a RAG-backed chat agent) is the aggregation point, and its connected tools and data sources become the repository being pillaged. The adversary goal—Collection of internal data via a trusted centralized access layer—is functionally the same.

Creating a proxy AI model — training a substitute from representative data, replicating a target via its inference API, or reusing a pre-trained model — has no meaningful parallel in traditional ATT&CK, which concerns intrusion into networks and hosts rather than approximating the behavior of an ML model. The adversary goal here is to build an offline stand-in that mimics the victim's model so attacks can be developed and validated without touching victim infrastructure, a concept unique to ML systems. ATT&CK resource-development techniques like Develop Capabilities focus on tooling such as malware, not on functionally cloning a target's decision logic.

This technique involves an adversary confirming that a crafted adversarial input (e.g., an evasion or poisoning payload) actually fools the target ML model before real-world deployment, by testing it against an inference API or a stolen offline copy of the model. ATT&CK's ML Attack Staging concepts do not exist in the enterprise matrix, and there is no traditional ATT&CK technique whose goal is validating that a machine-learning-specific attack payload produces the intended misclassification. The closest traditional analogue would be adversary testing of malware against detection engines, but that targets security tooling rather than the semantics of an ML model, so the parallel is too weak to be conceptual.

Crafting adversarial data means mathematically perturbing model inputs (e.g. subtly altering pixels in an image) to force a misclassification, missed detection, or resource exhaustion, while the input still looks normal to a human. This exploits the learned decision boundaries of an ML model itself, which has no analogue in traditional ATT&CK techniques that target software vulnerabilities, credentials, or system configurations. No ATT&CK technique describes manipulating a model's statistical behavior through optimized input perturbations, so this is AI-unique.

Generating deepfakes serves the same adversary goal as ATT&CK's Impersonation technique: assuming the trusted identity of a real person or persona to deceive a target into acting (e.g. authorizing a transfer, disclosing credentials) or to bypass identity checks. The key difference is the means: ATLAS T0088 uses GenAI to fabricate convincing synthetic imagery, video, audio, or text at scale, whereas T1656 describes impersonation more broadly (e.g. spoofed messages posing as a colleague). The deepfake is the enabling artifact that makes the impersonation credible.

This technique produces malicious commands or scripts that are subsequently run through a command/scripting interpreter on the victim host, which is exactly the adversary goal captured by ATT&CK T1059. The distinguishing feature here is that the commands are generated dynamically by an LLM rather than hardcoded, making the resulting execution polymorphic and harder to fingerprint, but the underlying execution behavior maps cleanly to Command and Scripting Interpreter.

A reverse shell gives the adversary an interactive command interpreter on the victim by having the compromised host connect outbound to an attacker-controlled listener, which maps closely to ATT&CK's Command and Scripting Interpreter used to run arbitrary commands. The reverse-connection pattern itself also overlaps with T1571 Non-Standard Port and T1571/T1071 command-and-control behaviors, but the core outcome—remote command execution on the victim—is captured by T1059. In the ATLAS context this typically follows exploitation of an ML serving component or notebook environment.

This ATLAS technique describes using a legitimate AI service's API (e.g., OpenAI Assistants API) as a covert command-and-control channel, where adversary commands and results blend into normal AI traffic. This maps closely to ATT&CK T1102 Web Service, which covers adversaries using existing, legitimate external web services to relay commands and exfiltrate data because such traffic is trusted and hard to distinguish from benign activity. The AI-service specificity is the only meaningful difference; the adversary goal—stealthy C2 over a trusted third-party API—is identical, making this a strong conceptual match.

Both techniques abuse a trusted, already-present capability to broker adversary commands rather than deploying a custom C2 implant. In ATT&CK T1102, adversaries use a legitimate external web service as the relay for command retrieval and exfiltration; here the AI agent plays the analogous role of a trusted intermediary that fetches and executes attacker instructions via its tool-calling ability. The parallel is conceptual because the agent is an on-system autonomous actor driven by prompt injection, not a purely external channel, but the adversary goal of using a legitimate, low-suspicion component for C2 is the same.

Both techniques abuse a legitimate, network-accessible service interface to move sensitive data out of the target environment; in ATT&CK the adversary uses an external web service as the exfiltration channel, while here the AI model's inference API is the channel. The adversary sends crafted queries and reconstructs private training data, membership information, or the model's parameters from the responses, so the API responses themselves become the exfiltration path. This is the closest ATT&CK analogue because the goal (data theft over a sanctioned service endpoint) is identical, even though the extraction relies on statistical inference rather than direct file transfer.

This ATLAS technique describes stealing AI artifacts (model weights, training data, hyperparameters) using conventional exfiltration methods rather than AI-specific extraction. The adversary goal and mechanics are identical to standard ATT&CK exfiltration, where data is moved out over an existing command-and-control or network channel; the only distinction is that the stolen asset is an ML artifact. T1041 is the closest single analogue, though the broader TA0010 Exfiltration tactic (T1048 over alternate protocol, T1567 over web service) applies equally depending on the channel used.

Extracting an LLM system prompt relies on manipulating the model's natural-language behavior (via prompt injection) to disclose hidden instructions that define its role and guardrails. This attack vector is intrinsic to how generative AI models process instructions and has no meaningful equivalent in ATT&CK, which addresses credential, file, and system-data theft rather than coaxing a model into revealing its own configuration text. While the alternate path of reading a config file superficially resembles ATT&CK data-collection techniques, the technique's defining goal—recovering the proprietary prompt that governs model behavior—is AI-specific.

This technique relies on natural-language prompt manipulation to coax an LLM into revealing data embedded in its training set, connected data sources, or other users' session context—an attack surface that only exists because the model itself is the disclosure vector. Traditional ATT&CK exfiltration and collection techniques assume the adversary accesses files, databases, or network channels directly; here there is no compromised system or channel, only a legitimate inference API returning sensitive content in response to crafted input. Because the leakage mechanism is inherent to how generative models process and reproduce data rather than any conventional access or exfiltration path, there is no close ATT&CK analogue.

This ATLAS technique tricks an LLM into embedding private data inside a rendered image URL (or HTML/markdown), so when the victim's client auto-loads the resource it silently sends the data to an attacker-controlled web server via request parameters. This maps conceptually to ATT&CK's Exfiltration Over Web Service, where adversaries route stolen data out over legitimate outbound web/HTTP requests to blend with normal traffic. The AI-specific twist is that the LLM itself, not malware, is the vector that authors the exfiltration channel and the client rendering engine executes it with zero user interaction.

This ATLAS technique achieves the classic exfiltration goal—moving sensitive data to an adversary-controlled destination—but uses an AI agent's legitimate write-capable tools (email senders, document creators, CRM updaters, API callers) as the transport channel rather than a directly controlled command channel. It maps conceptually to T1567 because the data ultimately leaves the environment through legitimate external web services and applications, blending with normal application traffic. It differs in that the adversary never touches the exfiltration mechanism directly; they coerce the AI agent via prompt injection or a poisoned tool to embed the data in benign-looking tool parameters.

Denial of AI Service shares the same adversary goal as ATT&CK's Endpoint Denial of Service: exhausting a service's resources through a flood of requests to degrade or shut it down. The AI-specific twist is that adversaries craft inputs that force disproportionately heavy inference compute (e.g., large token contexts or adversarial queries), so a low request volume can overwhelm expensive GPU/accelerator bottlenecks. T1499's application/resource-exhaustion flooding subtechniques are the closest ATT&CK analogue, though ATT&CK does not model the compute-per-request amplification unique to ML inference.

This ATLAS technique floods an AI system with junk ("chaff") inputs to trigger excessive detections or human-in-the-loop review events, exhausting analyst time and degrading the organization's ability to respond—a resource-exhaustion goal that mirrors ATT&CK's Endpoint Denial of Service. The key difference is that the exhausted resource is human review capacity and detection triage rather than compute or network availability, but the adversary intent (degrading availability/usability of a defensive capability through volumetric flooding) is closely analogous. It is conceptual rather than formal because ATLAS provides no official cross-reference and the target is the AI inference/alerting pipeline instead of a traditional service endpoint.

This technique relies on feeding crafted adversarial inputs to a deployed model to steadily degrade its prediction accuracy, causing the victim to lose trust in the system's outputs. There is no meaningful ATT&CK parallel because ATT&CK's impact techniques target the availability or integrity of data, services, and hardware, whereas this attacks the statistical correctness of an ML model's inferences without touching the underlying infrastructure. The closest ATT&CK concepts (e.g., Data Manipulation) alter stored data directly, not the learned behavior of a model via inference-time inputs.

ATT&CK's Resource Hijacking (T1496) is the closest analogue because both techniques abuse a victim's compute resources to cause impact, and T1496 explicitly includes sub-techniques for driving up cloud costs by consuming metered services. The key distinction is intent: Cost Harvesting aims to inflate the victim's bill through high-volume or resource-intensive AI queries rather than co-opting resources for the adversary's own workloads, but the resource-consumption mechanism and Impact-tactic goal align closely enough for a conceptual mapping.

External Harms is an outcome-focused technique describing the real-world consequences an adversary inflicts on the organization, its users, or the public (financial, reputational, user, or societal harm) by abusing a compromised ML system. ATT&CK's Impact tactic (e.g. T1496 Resource Hijacking, T1531 Account Access Removal) describes technical effects on the victim's own IT systems, whereas ATLAS External Harms centers on downstream, often non-technical damage that flows outward from misuse of an AI model's capabilities — a framing with no meaningful ATT&CK equivalent.

Erode Dataset Integrity is a data-manipulation impact: the adversary corrupts or poisons portions of a training/reference dataset so the data can no longer be trusted, forcing defenders to spend resources validating and cleaning it. This maps conceptually to ATT&CK's Data Manipulation (T1565), which covers inserting, deleting, or altering stored data to influence outcomes or undermine confidence in data integrity. The distinction is that ATLAS targets ML datasets specifically to degrade model reliability, whereas T1565 is a general data-integrity attack, so the relationship is conceptual rather than formal.

The adversary's end goal—destroying data and files to interrupt availability—is identical to ATT&CK's Data Destruction (T1485); the only novel element is the delivery mechanism, where an AI agent's mutative tool (e.g., a file-deletion or database-write function) is coerced into executing the destruction rather than the adversary running commands directly. Because the impact and objective match a well-established ATT&CK technique, this is a conceptual mapping rather than AI-unique.

This ATLAS technique achieves the same adversary goal as classic exploitation for execution: the attacker gains arbitrary code execution on a victim machine, but the exploited vector is an AI-enabled component (a local AI agent or a malicious model artifact) rather than a traditional client application. ATT&CK's T1203 covers exploiting software processing adversary-controlled input to run code, which closely parallels compromising a local AI agent through crafted prompts/inputs or loading an artifact with embedded malware. The downstream outcomes ATLAS describes (credential theft, data exfiltration, persistence) are standard post-compromise ATT&CK behaviors, but the initial machine compromise itself maps most directly to execution-via-exploitation.