{"id":"T1700","name":"AI-Enabled Exfiltration","url":"https://attack.mitre.org/techniques/T1700","tactics":["exfiltration"],"platforms":["Windows","SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0927","stix_id":"x-mitre-detection-strategy--0567c079-3df3-404a-b69d-1690efd638b4","name":"Detect AI-Enabled Exfiltration","url":"https://attack.mitre.org/detectionstrategies/DET0927","analytics":[{"id":"AN2079","stix_id":"x-mitre-analytic--d701cd5a-fa95-4c94-808b-ceb44120314d","name":"Analytic 2079","description":"An analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection to a destination outside $AuthorizedAIEndpoints$ from the same process lineage.","url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2079","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"AuthorizedAIDataScope","description":"data paths/classes the AI application/service identity is permitted to access; derive from application design, IAM and data policy"},{"field":"ExpectedAIProcessTree","description":"approved AI parent/child relationships from clean executions"},{"field":"AuthorizedAIEndpoints","description":"legitimate service/repository/API destinations"},{"field":"EndpointExfilWindow","description":"access→execution→egress timing derived from clean workflows"}],"live":true,"detection_strategies":["DET0927"],"techniques":["T1700"]},{"id":"AN2078","stix_id":"x-mitre-analytic--68906af9-7457-4285-9663-0d6ae7afccf4","name":"Analytic 2078","description":"An analyst observes an AI agent access $ProtectedDataScope$, invoke a tool/API using that information or a derived payload, and the destination service record a successful transfer to a recipient, repository, tenant, domain, or service outside $AuthorizedAIDataFlows$.","url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2078","platforms":["SaaS"],"log_source_references":[{"name":"saas:audit","channel":"Actual send/share/upload/write operation","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-audit"},{"name":"AWS:bedrock","channel":"AgentTrace.actionGroupInvocationInput","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"aws-bedrock"},{"name":"AWS:bedrock","channel":"AgentTrace.knowledgeBaseLookupInput","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"aws-bedrock"}],"mutable_elements":[{"field":"ProtectedDataScope","description":"protected information"},{"field":"AuthorizedAgentActions","description":"tools/functions legitimately available for workflow"},{"field":"AuthorizedAIDataFlows","description":"allowed source→tool→destination relationships"},{"field":"AuthorizedAIOutputDestinations","description":"permitted recipients/domains/tenants/repos/connectors"},{"field":"AIExfiltrationWindow","description":"normal access→transfer interval"}],"live":true,"detection_strategies":["DET0927"],"techniques":["T1700"]},{"id":"AN2080","stix_id":"x-mitre-analytic--5e07498b-9aba-41fa-bd95-212f9a9dc2fe","name":"Analytic 2080","description":"An analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection from the same lineage to a destination outside $AuthorizedAIEndpoints$.","url":"https://attack.mitre.org/detectionstrategies/DET0927#AN2080","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open/read","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"EXECVE","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"connect","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"AuthorizedAIDataScope","description":"data paths/classes the AI application/service identity is permitted to access; derive from application design, IAM and data policy"},{"field":"ExpectedAIProcessTree","description":"approved AI parent/child relationships from clean executions"},{"field":"AuthorizedAIEndpoints","description":"legitimate service/repository/API destinations"},{"field":"EndpointExfilWindow","description":"access→execution→egress timing derived from clean workflows"}],"live":true,"detection_strategies":["DET0927"],"techniques":["T1700"]}],"live":true,"version":"1.0","techniques":["T1700"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-10-17 09:25 UTC","_attack_version":"20.0","_sigma_commit":"c04ad420b46c0fb4dba3ce55ce52d0e4f570cc86"}