MITRE ATLAStactic
AML.TA0005 Execution
- Created
- 2022-01-24
Description
The adversary is trying to run malicious code embedded in AI artifacts or software.
Execution consists of techniques that result in adversary-controlled code running on a local or remote system.
Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data.
For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.
Related
Att&ck equivalent · MITRE ATT&CK (1)
- TA0002 Execution tactic
Referenced by MITRE ATLAS · tactic (13)
- AML.T0011.002 Poisoned AI Agent Tool sub-technique
- AML.T0011.003 Malicious Link sub-technique
- AML.T0103 Deploy AI Agent technique
- AML.T0100 AI Agent Clickbait technique
- AML.T0051.002 Triggered sub-technique
- AML.T0011.001 Malicious Package sub-technique
- AML.T0051 LLM Prompt Injection technique
- AML.T0051.000 Direct sub-technique
- AML.T0051.001 Indirect sub-technique
- AML.T0053 AI Agent Tool Invocation technique
- AML.T0050 Command and Scripting Interpreter technique
- AML.T0011 User Execution technique
- AML.T0011.000 Unsafe AI Artifacts sub-technique