MITRE ATLAS Mapped 2026 – Top AI LLM System Information Discovery Detection (AML
Detects reconnaissance activities where users submit prompts containing keywords typically used to probe LLM internals, such as system prompts, special instructions, or configuration details. This behavior is often indicative of precursor activity for prompt injection or jailbreak attempts.
Microsoft Sentinel (KQL)
