MITRE ATLAS Mapped 2026 – Top AI False RAG Entry Injection Detection (AML.T0071)
Detects anomalous data ingestion events in a Retrieval-Augmented Generation (RAG) pipeline. The rule flags 'Create' operations performed outside of scheduled batch ingestion jobs by identities that have not previously ingested data into the index. It further filters for ingested content that does not match any known document hashes within the existing corpus, identifying potential unauthorized or malicious document injection.
Microsoft Sentinel (KQL)
