MITRE ATLAS Mapped 2026 – Top AI Denial of AI Service Detection (AML.T0029)
This rule detects potential Denial of Service (DoS) attacks against AI inference endpoints. It monitors for sustained high latency and high error rates combined with a high volume of 'heavy' requests (those exceeding a token/character count threshold) from specific source IPs. This pattern suggests an attempt to exhaust system resources by forcing the processing of complex or overly large prompts.
Microsoft Sentinel (KQL)
