// MITRE ATT&CK
T1682 · Query Public AI Services
🎯 Reconnaissance PRE
Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), adver...
¿Cómo detectarlo y mitigarlo?
La detección de Query Public AI Services parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Técnicas relacionadas
T1592
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1596.002
WHOIS T1594
Search Victim-Owned Websites T1596.001
DNS/Passive DNS
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1596.002
WHOIS T1594
Search Victim-Owned Websites T1596.001
DNS/Passive DNS
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.