Map one attack path through your lab to ATLAS and find the gaps

short · 40 min · Objective 2.1

Task

Write the path an adversary would take to get the canary out of docs/restricted/salaries.md through your lab, map each step to a MITRE ATLAS or ATT&CK tactic and technique, and then check, against the real fields in your gateway log, which of those steps you would actually see.

Steps

  1. Create lab/atlas-chain.csv with header step,tactic,atlas_only,technique_id,technique_name,lab_component,log_field,detected.
  2. Write at least five steps for the goal "obtain the canary through the assistant", in order from first contact to exfiltration. Include the ordinary steps the lesson says real chains start with -- finding the service and getting an account that can reach it -- as well as the AI-specific ones.
  3. For each step, look up the tactic and technique on ATLAS and record its identifier exactly as published (ATLAS identifiers start AML.T). Where the step is a conventional one that ATLAS borrows from ATT&CK, record the ATT&CK identifier instead (they start T1). Set atlas_only to yes for steps under a tactic ATT&CK does not have, such as gaining access to the model or staging an attack against it.
  4. Set lab_component to the part of your lab the step touches, and detected to yes only if a field in logs/gateway.jsonl would show the step. Put that field's exact name in log_field.
  5. For every detected=no step, write one line in lab/atlas-gaps.md starting - , naming the detection you would need and where its data would come from.
  6. Read one ATLAS case study and record in lab/atlas-case-study.md three lines: case_study=<name>, conventional=<n> and ai_specific=<n>, counting its steps under tactics shared with ATT&CK and under ATLAS-only tactics.

Verify

Run from ~/secai-lab.

python - <<'EOF'
import csv, json
rows = list(csv.DictReader(open("lab/atlas-chain.csv", newline="")))
fields = set(json.loads(open("logs/gateway.jsonl").readline()))
print(len(rows), "step(s)")
print(sum(r["technique_id"].startswith("AML.T") for r in rows), "ATLAS technique(s)")
print(sum(r["technique_id"].startswith("T1") for r in rows), "ATT&CK technique(s)")
print(sum(r["atlas_only"] == "yes" for r in rows), "step(s) under an ATLAS-only tactic")
bad = [r["step"] for r in rows if r["detected"] == "yes" and r["log_field"] not in fields]
print("detected steps naming a field the log does not have:", bad or "none")
print(sum(r["detected"] == "no" for r in rows), "undetected step(s)")
EOF
grep -c '^- ' lab/atlas-gaps.md
grep -cE '^(case_study|conventional|ai_specific)=' lab/atlas-case-study.md

Five or more steps, at least one ATLAS technique AND at least one ATT&CK technique, at least one ATLAS-only step, no detected step naming a field your log lacks, as many gap lines as undetected steps, and 3 for the case study. A chain with no ATT&CK step has skipped how the adversary reached the gateway in the first place, which is the lesson's point about real case studies.

Notes

Expect the early steps to be the undetected ones. The gateway log records requests that arrive; it says nothing about someone discovering that port 8088 exists or obtaining a valid user. That is exactly where the existing detection estate -- authentication logs, network monitoring -- already does the work, and why the lesson says the AI-specific detections are the few new ones.

This is an independent study companion for CompTIA SecAI+ CY0-001 and is not produced by or endorsed by CompTIA.