AML-ATLAS-2026-17 | MITRE ATLAS Mapped 2026 – Top AI Threat Detection: Malicious AI Software Supply Chain Compromise (AML.T0010.001)
Detects execution of package management commands (pip, npm, conda) that attempt to pull packages from registries other than the approved internal repositories. This behavior is indicative of potential AI supply-chain compromise, including malicious packages or namesquatting targeted at machine-learning or LLM-related development workflows.
Microsoft Sentinel (KQL)
