Reconnaissance

Type: tactic

Description: The adversary is trying to gather information about the GenAI system they can use to plan future operations.

Version: 0.1.0

Created At: 2025-03-04 10:27:40 -0500

Last Modified At: 2025-03-04 10:27:40 -0500

Tactic Order: 1

External References

  • <-- Gather RAG-Indexed Targets (technique): An adversary could gather intelligence about GenAI systems to find vulnerabilities related to external data sources it uses and perform subsequent attacks that exploit these dependencies, such as data poisoning or indirect prompt injections.
  • <-- Search Victim-Owned Websites (technique): Gathering information from victim-owned websites to understand machine learning usage and vulnerabilities.
  • <-- Search for Victim's Publicly Available Research Materials (technique): Gathering publicly available research materials allows adversaries to understand how and where machine learning is utilized within a target organization, aiding in planning tailored attacks.
  • <-- Search for Victim's Publicly Available Code Repositories (technique): Gathering publicly available code repositories allows adversaries to understand how and where machine learning is utilized within a target organization, aiding in planning tailored attacks.
  • <-- Search Application Repositories (technique): Gathering information from application repositories to identify potential vulnerabilities or machine learning implementations.
  • <-- Active Scanning (technique): An adversary that can access exposed AI resources might be able to exploit weaknesses, gather intelligence, or perform unauthorized actions in an AI systems.