MITRE ATT&CK Mapping

What this is for

MITRE ATT&CK is the matrix most security operations teams already use to describe adversary behavior. Version 20 (October 2026) is the first release with techniques for the abuse of AI systems: prompt injection, exfiltration through AI agents, and supply-chain attacks through coding-agent configuration. This page lists the techniques Guardway detections map to, so your SOC can pivot on the same IDs in Guardway, in its SIEM, and in its threat models.

A technique tag says a detection is evidence of that behavior, not that an attack succeeded. Posture and governance findings (an agent whose permission prompts are off, a skill outside the approved list) describe exposure, not adversary behavior, and carry no technique.

AI techniques added in ATT&CK v20

Technique	Tactic	Where Guardway sees it
T1699 Direct Prompt Injection	Execution	Gateway guardrails: injection in the user or system text sent to a model.
T1698 Indirect Prompt Injection	Execution	Gateway guardrails: injection in a tool result, including MCP tool results through the gateway. Endpoint scans: injected instructions, hidden Unicode and tool poisoning in installed skills and MCP servers.
T1700 AI-Enabled Exfiltration	Exfiltration	Gateway guardrails: data-exfiltration injection. Live guard: an agent reading a credential and sending data out in one command, or reading it and uploading later in the same session. Endpoint scans: skills that read secrets and send them out, MCP servers with exfiltration-capable scopes.
T1195.001 Compromise Software Dependencies and Development Tools	Initial Access	Updated in v20 to cover coding-agent configuration and `SKILL.md` files. Endpoint scans: auto-run agent hooks with dangerous shell, known-malicious and typosquatted packages, unpinned dependencies, install-time fetch-and-execute, and vendor skills that differ from every verified release.
T1685.007 Impair Autonomous Defenses	Defense Impairment	Not covered. No Guardway detection targets injection aimed at LLM-assisted security analysis yet.
T1608.007 AI Result Poisoning	Resource Development	Not covered, by design. It happens on the open web before any enterprise system is involved; MITRE notes that enterprise telemetry cannot tell it apart from ordinary publishing.

Other techniques Guardway detections map to

Technique	Detections
T1059 Command and Scripting Interpreter, T1059.004 Unix Shell	Downloads piped into a shell (in a skill or run by an agent), MCP servers that run a shell, dangerous execution primitives in skills.
T1105 Ingress Tool Transfer	Remote downloads piped into a shell, release binaries downloaded by a skill.
T1095 Non-Application Layer Protocol	Raw network sockets in a skill.
T1027 Obfuscated Files or Information	Obfuscated or dynamically evaluated code, hidden Unicode, padded instruction files.
T1552 Unsecured Credentials, T1552.001 Credentials In Files	Hardcoded credentials in skills, MCP configuration and projects; an agent reading a credential store.
T1548 Abuse Elevation Control Mechanism	Privilege escalation in a skill.
T1546 Event Triggered Execution	Auto-run agent hooks with dangerous shell.
T1485 Data Destruction	Destructive shell commands in a skill, or proposed by an agent.

Where the technique IDs appear

Logs: a guardrail event the gateway tagged shows an ATT&CK row in its details.
Fleet › AIDR: the MITRE ATT&CK for AI card lists each AI technique, the rules and gateway guardrails that cover it, and its hits across the fleet. A technique nothing covers is marked Not covered. A selected detection names its techniques.
Findings: skill findings and an endpoint’s runtime findings show technique IDs beside their OWASP tags, each named with its tactic on hover.
SIEM exports: guardrail events from the gateway and endpoint events from the cloud carry the IDs. CEF puts them in flexString2 (label mitreTechnique), LEEF in a mitreTechnique attribute, and Datadog adds one mitre_technique:<id> tag per technique. JSON-based exports (Splunk HEC, NDJSON, Google SecOps, and Microsoft Sentinel’s Data column) carry an attack array.
Guardway CLI: gw-cli scan prints the IDs beside each finding’s OWASP tags.

The console views roll out per organization. Ask your Guardway contact to turn them on.

Getting Started

Platform

Guardway MCP

Gateway

Inventory

Endpoint AI Risk

Resources

API Reference

MITRE ATT&CK Mapping

What this is for

AI techniques added in ATT&CK v20

Other techniques Guardway detections map to

Where the technique IDs appear

​What this is for

​AI techniques added in ATT&CK v20

​Other techniques Guardway detections map to

​Where the technique IDs appear

​Related

What this is for

AI techniques added in ATT&CK v20

Other techniques Guardway detections map to

Where the technique IDs appear

Related