MITRE ATLAS 2026 Top AI Detection: Active Scanning of Exposed AI Model-Serving Infrastructure [AML.T0006.002]
Detects external reconnaissance activity targeting AI backend services. Adversaries scan for known AI infrastructure ports (such as TensorFlow Serving, Triton, or Ray) and common API paths (e.g., /v1/models, /predict) to identify potential targets. The detection utilizes proxy logs to correlate these suspicious network attributes, high request rates, or known scanning user agents.
Sigma
