ML Training Data / Model Poisoning via Unauthorized Pipeline Writes

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•1

Detects unauthorized write or modification operations against machine learning training data, feature stores, and model registries. The rule identifies suspicious activity by flagging actions occurring outside established change windows, attempts by identities with no prior history of modifying the resource, or bulk data modifications that could indicate training data poisoning or model tampering.