MITRE ATT&CK v20: Defending Against AI Abuse, MFA Bypass, and ICS Attacks on Water Utilities — Detection Strategies and Hunt Queries

MITRE has released version 20 of the ATT&CK knowledge base, and this update is not a routine catalog refresh. It delivers 15 new detection strategies — six for Enterprise and nine for ICS — backed by 38 analytics, squarely aimed at three of the most operationally significant threat themes of the past year: adversary abuse of AI platforms, multi-factor authentication bypass, and intrusions targeting water and wastewater utilities.

If you run a SOC or an MDR program, this is your cue to update your detection backlog. ATT&CK detection strategies and their associated analytics are the closest thing the industry has to a canonical answer for "what telemetry do I need, and what logic should I apply to it?" When MITRE publishes new strategies for MFA bypass and ICS intrusions, it is codifying behaviors that defenders have been catching — or missing — in real incidents. The water utility focus is especially pointed: the sector has absorbed repeated intrusions from state-linked and hacktivist actors exploiting internet-exposed HMIs, default credentials on PLCs, and flat OT networks. v20 gives those defenders structured, vendor-neutral detection content for the first time at this depth.

This post breaks down what changed, what the underlying attack behaviors look like from the defender's side of the wire, and provides production-ready detection content you can adapt today.

Technical Analysis: What v20 Actually Adds

The Detection Strategy Model

Before v20's specifics, understand the construct. An ATT&CK detection strategy pairs a technique with the data sources and collection requirements needed to observe it, and each strategy carries one or more analytics — portable detection logic descriptions. The 38 new analytics in v20 represent MITRE's editorial judgment on which behaviors are both prevalent in current campaigns and detectable with telemetry defenders realistically have. That second criterion matters: these are not aspirational detections requiring exotic sensors.

Threat Theme 1: AI Abuse

v20 formalizes adversary use of AI platforms — a shift from theoretical concern to observed tradecraft. From the defender's perspective, AI abuse manifests in three observable ways:

1. AI-assisted operations from your endpoints: adversaries or malicious insiders sending sensitive data (source code, credentials, customer records) to external LLM APIs — a data exfiltration channel that sails past DLP rules written for Dropbox and personal Gmail.
2. Abuse of enterprise AI deployments: prompt injection and tool-abuse against internally deployed copilots and RAG pipelines to reach data the user shouldn't touch.
3. AI-platform credential theft and token reuse: stolen API keys and session tokens for AI services used to pivot or to run adversary infrastructure on your bill.

The first pattern is the most immediately actionable for most SOCs: connections to AI API endpoints from processes that have no business talking to them — script interpreters, Office applications, LOLBins, unsigned binaries in user profile directories.

Threat Theme 2: MFA Bypass

The new Enterprise detection strategies address what IR teams have been living since AiTM (adversary-in-the-middle) phishing kits went mainstream: MFA is no longer a hard boundary. The dominant bypass paths we see in engagements are:

• Session cookie theft via AiTM phishing (Evilginx-class kits): the victim authenticates fully — MFA included — and the attacker harvests the resulting session token. No MFA alert ever fires because authentication legitimately succeeded.
• MFA fatigue / push bombing: flooding push notifications until a user approves, often combined with a vishing call posing as IT.
• Authentication method manipulation: an attacker with initial access (or a help-desk social engineer) registers a new phone number, FIDO key, or TOTP app, then authenticates through the attacker-controlled factor.
• Legacy protocol fallback: IMAP/POP/basic SMTP auth that bypasses conditional access entirely where it's still enabled.

Detection hinges on correlating identity telemetry: sign-in anomalies, authentication method changes, and impossible-travel signals — plus endpoint telemetry for the cookie theft that precedes token replay.

Threat Theme 3: Water Utility / ICS Attacks

The nine new ICS detection strategies reflect the reality of water-sector intrusions: small utilities running internet-reachable HMIs (often VNC or vendor remote access with default credentials), engineering workstations dual-homed between IT and OT, and PLCs that accept unauthenticated writes over Modbus, CIP, or vendor-proprietary protocols. The attack chain in recent water-sector incidents has been depressingly consistent: scan for exposed HMI → authenticate with default or brute-forced creds → manipulate setpoints or display misleading values → optionally detonate IT-side ransomware as a distraction.

Defensively, the highest-fidelity signals are: unexpected writes to PLCs from non-engineering-workstation sources, new remote access sessions into OT assets outside maintenance windows, and HMI configuration changes that aren't tied to a change ticket.

Exploitation Status

These are technique-level updates, not a single CVE — there is no patch. The behaviors v20 catalogs (AiTM phishing, MFA fatigue, exposed ICS HMI exploitation, AI API abuse) are confirmed, actively exploited in the wild across multiple campaigns and sectors. Treat operationalization of these detection strategies with the same urgency you'd give a KEV-listed vulnerability affecting your stack.

Detection & Response

The following detections target the three v20 themes. Every rule is built on behaviors with low legitimate variance — tune thresholds to your baseline, but these should not be noisy by design.

---
title: Authentication Method Modification via Microsoft Graph PowerShell
id: 3f8a1c92-7d54-4e6b-a9c1-2b5d8f0e4a67
status: experimental
description: Detects use of Microsoft Graph or AzureAD PowerShell cmdlets to add or modify user authentication methods, a common MFA bypass step after initial account compromise or help-desk social engineering.
references:
  - https://attack.mitre.org/techniques/T1556/
  - https://attack.mitre.org/techniques/T1098/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1098.001
  - attack.t1556
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'New-MgUserAuthenticationPhoneMethod'
      - 'New-MgUserAuthenticationMicrosoftAuthenticatorMethod'
      - 'New-MgUserAuthenticationFido2Method'
      - 'Set-MsolUser -StrongAuthenticationMethods'
      - 'Update-MgUserAuthentication'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate IAM provisioning scripts run from designated admin workstations — whitelist by parent process and host
level: high
---
title: Suspicious Process Connecting to AI Platform API Endpoints
id: 8c2e4b71-3a96-4d28-bc45-9f1e7a6d2038
status: experimental
description: Detects script interpreters, Office applications, and unsigned binaries establishing network connections to major AI platform API endpoints, consistent with AI-assisted data exfiltration or adversary use of LLM APIs for tooling.
references:
  - https://attack.mitre.org/techniques/T1567/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567
  - attack.command_and_control
logsource:
  category: network_connection
  product: windows
detection:
  selection_dst:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
      - 'api.groq.com'
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_dst and selection_img
falsepositives:
  - Approved developer tooling using AI APIs — maintain an allowlist of sanctioned scripts and service accounts; unsanctioned interpreters hitting LLM endpoints are worth an alert
level: medium

// Hunt: MFA bypass indicators — new authentication method registration followed by anomalous sign-in
// Correlate Entra ID audit events for auth method changes with risky sign-in patterns within 4 hours
let window = 4h;
let AuthMethodChanges =
    AuditLogs
    | where TimeGenerated > ago(7d)
    | where OperationName has_any ("User registered security info", "Update user", "Add phone authentication method", "Register FIDO2 security key")
    | where Result == "success"
    | extend TargetUser = tostring(TargetResources[0].userPrincipalName)
    | extend Actor = tostring(InitiatedBy.user.userPrincipalName)
    | where Actor != TargetUser or Actor startswith "svc_" or isempty(Actor)  // self-service is lower risk; admin/help-desk changes on others, and obfuscated actors, are higher
    | project ChangeTime = TimeGenerated, TargetUser, Actor, OperationName, CorrelationId;
AuthMethodChanges
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(7d)
    | where ResultType == 0
    | extend LocationString = strcat(Location, "|", tostring(LocationDetails.countryOrRegion))
    | project SigninTime = TimeGenerated, UserPrincipalName, IPAddress, LocationString, AppDisplayName, AuthenticationRequirement, AuthenticationDetails, DeviceDetail
) on $left.TargetUser == $right.UserPrincipalName
| where SigninTime between (ChangeTime .. ChangeTime + window)
| summarize SignInCount = count(), IPs = make_set(IPAddress), Locations = make_set(LocationString), Apps = make_set(AppDisplayName)
    by TargetUser, Actor, OperationName, ChangeTime
| extend DistinctIPs = array_length(IPs)
| where DistinctIPs > 1 or SignInCount > 5
| sort by ChangeTime desc

// Hunt: possible MFA fatigue — burst of denied/abandoned MFA attempts followed by a success
SigninLogs
| where TimeGenerated > ago(3d)
| extend AuthResult = tostring(Status.errorCode)
| summarize
    FailedMFA = countif(ResultType in (500121, 500121)) ,  // strong auth failures
    Denied = countif(ResultType != 0),
    Succeeded = countif(ResultType == 0),
    FirstAttempt = min(TimeGenerated),
    LastAttempt = max(TimeGenerated)
    by UserPrincipalName, IPAddress, bin(TimeGenerated, 30m)
| where Denied >= 5 and Succeeded >= 1
| extend WindowMinutes = datetime_diff("minute", LastAttempt, FirstAttempt)
| project UserPrincipalName, IPAddress, Denied, Succeeded, WindowMinutes, FirstAttempt
| sort by Denied desc

-- Hunt: suspicious access to browser credential/session stores (AiTM-style cookie theft enabling MFA bypass via token replay)
-- Session cookies harvested from Chrome/Edge/Edge profile directories let attackers replay authenticated sessions without triggering MFA.
LET cookie_paths = {
  "C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Network/Cookies",
  "C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Network/Cookies",
  "C:/Users/*/AppData/Local/Google/Chrome/User Data/Local State",
  "C:/Users/*/AppData/Local/Microsoft/Edge/User Data/Local State"
}

SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=cookie_paths)
WHERE Mtime > now() - 86400 * 3
ORDER BY Mtime DESC

-- Hunt: processes with live connections to AI API endpoints (pair with DNS/proxy telemetry for FQDN validation)
SELECT Pid, Name, Path, Raddr, Rport, Status, Username
FROM netstat()
WHERE Rport = 443
  AND Status =~ 'ESTAB'
  AND ( Name =~ '(powershell|pwsh|cmd|wscript|cscript|mshta|winword|excel|curl|wget)'
     OR Path =~ 'Users\\\\[^\\]+\\\\AppData\\\\Local\\\\Temp'
     OR Path =~ 'ProgramData\\\\[^\\]+\\\\[^\\]+\.exe$' )

Remediation & Hardening

There is no patch for a technique — but there is a great deal of hardening that directly blunts the behaviors v20 catalogs. Priorities, in order:

Identity / MFA Bypass

1. Enforce phishing-resistant MFA for all users — FIDO2/passkeys or certificate-based auth — and eliminate SMS/voice as factors wherever they remain. AiTM kits defeat push and OTP; they do not defeat WebAuthn origin binding.
2. Enable token protection / binding in Conditional Access (Entra ID) so stolen session cookies cannot be replayed from foreign devices. Pair with sign-in frequency and compliant-device requirements for sensitive apps.
3. Alert on authentication method changes using the KQL above, and require a second-admin approval workflow or help-desk verification procedure (out-of-band callback to a number on file) for factor resets.
4. Disable legacy authentication protocols tenant-wide (BlockLegacyAuth Conditional Access policy) and verify with the script below.
5. Tune MFA fatigue controls: enable number matching in Microsoft Authenticator (mandatory at this point — verify it's not disabled), and cap push attempts per hour per user.

# Verify tenant posture against MFA bypass vectors - run as Global Reader or higher
# Requires: Microsoft.Graph module (Install-Module Microsoft.Graph -Scope CurrentUser)
Connect-MgGraph -Scopes "Policy.Read.All","UserAuthenticationMethod.Read.All","AuditLog.Read.All" -NoWelcome

# 1) Check for a Conditional Access policy blocking legacy auth
$caPolicies = Get-MgIdentityConditionalAccessPolicy -All
$legacyBlock = $caPolicies | Where-Object {
    $_.Conditions.ClientAppTypes -contains 'exchangeActiveSync' -or
    $_.Conditions.ClientAppTypes -contains 'other'
} | Where-Object { $_.GrantControls.BuiltInControls -contains 'block' -and $_.State -eq 'enabled' }
if ($legacyBlock) {
    Write-Host "[OK] Legacy authentication block policy found: $($legacyBlock.DisplayName -join ', ')" -ForegroundColor Green
} else {
    Write-Host "[FAIL] No enabled CA policy blocking legacy auth - AiTM fallback path is open" -ForegroundColor Red
}

# 2) Find users with SMS or voice as an authentication method (phishable factors)
$users = Get-MgUser -All -Property Id,UserPrincipalName
$weak = foreach ($u in $users) {
    $phones = Get-MgUserAuthenticationPhoneMethod -UserId $u.Id -ErrorAction SilentlyContinue
    if ($phones) { [PSCustomObject]@{ User = $u.UserPrincipalName; PhoneType = ($phones.PhoneType -join ';') } }
}
Write-Host "[INFO] $($weak.Count) users still have phone-based auth methods registered" -ForegroundColor Yellow
$weak | Export-Csv -Path .\weak-mfa-users.csv -NoTypeInformation

# 3) Audit recent authentication method registrations in the last 72 hours
$since = (Get-Date).AddHours(-72).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $since" -All |
    Where-Object { $_.ActivityDisplayName -match 'security info|authentication method|FIDO2' } |
    Select-Object ActivityDateTime, ActivityDisplayName,
        @{N='Actor';E={$_.InitiatedBy.user.userPrincipalName}},
        @{N='Target';E={$_.TargetResources[0].userPrincipalName}}, Result |
    Format-Table -AutoSize

AI Abuse

• Inventory sanctioned AI usage, then proxy-block or CASB-control unsanctioned AI API endpoints. You cannot detect what you haven't defined as abnormal.
• Extend DLP rules to cover api.openai.com, api.anthropic.com, and peers — inspect upload payloads for code, credential patterns, and regulated data (PHI, PCI) the same way you treat personal cloud storage.
• Rotate and vault AI API keys; alert on key use from unexpected ASNs/geographies via your IdP or the provider's usage logs.

ICS / Water Utilities

• Remove internet exposure of HMIs and PLCs. Search Shodan/Censys for your own address space weekly; require VPN + MFA into a jump host for any OT remote access.
• Change every default credential on HMI, PLC, and historian platforms — this remains the single most common initial access vector in water-sector incidents.
• Deploy passive ICS protocol monitoring (even a SPAN port with Zeek's Modbus/DNP3 analyzers) and alert on function codes that write coils/registers or modify logic from any source other than the designated engineering workstation.
• Segment IT from OT per IEC 62443 zones/conduits; validate with a tabletop that assumes IT-side ransomware and tests whether operations can run isolated.
• Map your existing detection content to the nine new ICS strategies in ATT&CK v20 and track coverage as a formal metric — MITRE's published analytics give you a defensible baseline for board-level reporting.

Operationalize v20

Pull the updated STIX bundle from MITRE's CTI repository, diff the new detection strategies against your current rule library, and file detection-engineering tickets for gaps. The 38 new analytics are written to be vendor-portable — translating them into your SIEM's dialect is days of work, not months, and it closes coverage on techniques that are being used against organizations like yours right now.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub