> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MITRE ATT&CK Mapping

> Which MITRE ATT&CK v20 techniques Guardway detections are evidence of, including the AI-abuse techniques ATT&CK added in v20, and where the technique IDs appear.

## What this is for

[MITRE ATT\&CK](https://attack.mitre.org/) is the matrix most security operations teams already
use to describe adversary behavior. Version 20 (October 2026) is the first release with techniques
for the abuse of AI systems: prompt injection, exfiltration through AI agents, and supply-chain
attacks through coding-agent configuration. This page lists the techniques Guardway detections map
to, so your SOC can pivot on the same IDs in Guardway, in its SIEM, and in its threat models.

> [!NOTE]
>
> A technique tag says a detection is **evidence of** that behavior, not that an attack succeeded.
> Posture and governance findings (an agent whose permission prompts are off, a skill outside the
> approved list) describe exposure, not adversary behavior, and carry no technique.

## AI techniques added in ATT\&CK v20

| Technique | Tactic | Where Guardway sees it |
| - | - | - |
| [T1699 Direct Prompt Injection](https://attack.mitre.org/techniques/T1699/) | Execution | Gateway guardrails: injection in the user or system text sent to a model. |
| [T1698 Indirect Prompt Injection](https://attack.mitre.org/techniques/T1698/) | Execution | Gateway guardrails: injection in a tool result, including MCP tool results through the gateway. Endpoint scans: injected instructions, hidden Unicode and tool poisoning in installed skills and MCP servers. |
| [T1700 AI-Enabled Exfiltration](https://attack.mitre.org/techniques/T1700/) | Exfiltration | Gateway guardrails: data-exfiltration injection. Live guard: an agent reading a credential and sending data out in one command, or reading it and uploading later in the same session. Endpoint scans: skills that read secrets and send them out, MCP servers with exfiltration-capable scopes. |
| [T1195.001 Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001/) | Initial Access | Updated in v20 to cover coding-agent configuration and `SKILL.md` files. Endpoint scans: auto-run agent hooks with dangerous shell, known-malicious and typosquatted packages, unpinned dependencies, install-time fetch-and-execute, and vendor skills that differ from every verified release. |
| [T1685.007 Impair Autonomous Defenses](https://attack.mitre.org/techniques/T1685/007/) | Defense Impairment | **Not covered.** No Guardway detection targets injection aimed at LLM-assisted security analysis yet. |
| [T1608.007 AI Result Poisoning](https://attack.mitre.org/techniques/T1608/007/) | Resource Development | **Not covered, by design.** It happens on the open web before any enterprise system is involved; MITRE notes that enterprise telemetry cannot tell it apart from ordinary publishing. |

## Other techniques Guardway detections map to

| Technique | Detections |
| - | - |
| T1059 Command and Scripting Interpreter, T1059.004 Unix Shell | Downloads piped into a shell (in a skill or run by an agent), MCP servers that run a shell, dangerous execution primitives in skills. |
| T1105 Ingress Tool Transfer | Remote downloads piped into a shell, release binaries downloaded by a skill. |
| T1095 Non-Application Layer Protocol | Raw network sockets in a skill. |
| T1027 Obfuscated Files or Information | Obfuscated or dynamically evaluated code, hidden Unicode, padded instruction files. |
| T1552 Unsecured Credentials, T1552.001 Credentials In Files | Hardcoded credentials in skills, MCP configuration and projects; an agent reading a credential store. |
| T1548 Abuse Elevation Control Mechanism | Privilege escalation in a skill. |
| T1546 Event Triggered Execution | Auto-run agent hooks with dangerous shell. |
| T1485 Data Destruction | Destructive shell commands in a skill, or proposed by an agent. |

## Where the technique IDs appear

* **Logs:** a guardrail event the gateway tagged shows an **ATT\&CK** row in its details.
* **Fleet › AIDR:** the **MITRE ATT\&CK for AI** card lists each AI technique, the rules and gateway
  guardrails that cover it, and its hits across the fleet. A technique nothing covers is marked
  **Not covered**. A selected detection names its techniques.
* **Findings:** skill findings and an endpoint's runtime findings show technique IDs beside their
  OWASP tags, each named with its tactic on hover.
* **SIEM exports:** guardrail events from the gateway and endpoint events from the cloud carry the
  IDs. CEF puts them in `flexString2` (label `mitreTechnique`), LEEF in a `mitreTechnique`
  attribute, and Datadog adds one `mitre_technique:<id>` tag per technique. JSON-based exports
  (Splunk HEC, NDJSON, Google SecOps, and Microsoft Sentinel's `Data` column) carry an `attack`
  array.
* **Guardway CLI:** `gw-cli scan` prints the IDs beside each finding's OWASP tags.

The console views roll out per organization. Ask your Guardway contact to turn them on.

## Related

* [EU AI Act Mapping](https://docs.guardway.ai/resources/compliance/eu-ai-act.md)
* [ISO/IEC 42001 Mapping](https://docs.guardway.ai/resources/compliance/iso-42001.md)
* [Logs](https://docs.guardway.ai/platform/logs.md)
* [Fleet](https://docs.guardway.ai/endpoint-ai-risk/fleet.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.