A Microsoft Sentinel incident involves a threat actor performing model extraction by repeatedly querying an Azure OpenAI deployment with carefully crafted inputs to reconstruct the model's behavior. The security team wants to map this attack to the MITRE ATT&CK framework. Which MITRE ATT&CK for Enterprise tactic best describes model extraction?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because model extraction—where an attacker queries a model repeatedly to reconstruct its behavior or approximate its weights—is best mapped to the 'Exfiltration' tactic in the MITRE ATT&CK framework. The attacker is effectively stealing (exfiltrating) the intellectual property embodied in the model by collecting its outputs systematically.
Full explanation below image
Full Explanation
C is correct because model extraction—where an attacker queries a model repeatedly to reconstruct its behavior or approximate its weights—is best mapped to the 'Exfiltration' tactic in the MITRE ATT&CK framework. The attacker is effectively stealing (exfiltrating) the intellectual property embodied in the model by collecting its outputs systematically. In MITRE ATLAS (the AI-specific framework), this is also categorized as 'ML Model Theft.' B is wrong because Collection refers to gathering data from within the target environment to prepare for exfiltration; model extraction through API queries is the exfiltration itself, not the collection phase. A is wrong because Initial Access describes techniques to gain entry into the environment; model extraction assumes the attacker already has API access. D is wrong because Discovery involves learning about the environment (e.g., what services exist), whereas model extraction is an active data theft operation.