An intruder with read-only registry credentials copies an embedding encoder, then probes the search endpoint — which steps map to enterprise techniques?

## Split the campaign at the asset, not at the tool The useful cut in this intrusion is not early-stage versus late-stage. It is: which steps act on ordinary IT assets, and which act on assets that exist only because something was trained. **Maps cleanly onto a general enterprise matrix** - the initial corporate foothold, however it was obtained; - possession and use of read-only registry credentials; - discovery of what the registry holds; - collection and exfiltration of a stored file. A registry is a service with an authentication surface; a checkpoint on disk is a file. Every one of these steps is a well-catalogued behaviour, and a report that narrates them in the general vocabulary is doing the right thing. This half is why "the ML matrix is the enterprise one with a new skin" feels true to people who have only seen an ML incident summarised. **Has no cell in a general enterprise matrix** - *Probing the search endpoint to characterise the model.* Sending inputs and reading what comes back is authorised use of the service, and it is simultaneously measurement of the function behind it. No general catalogue contains an asset whose ordinary replies disclose its own behaviour, so there is no technique to name here. The only limit on the attacker is the query budget their credentials and any rate limiting allow. - *What the copy actually bought.* The file-collection cell records that bytes left. It does not record that those bytes are the deployed service's parameters, and that holding them moves the attacker from an input-only vantage to a white-box one: architecture and gradients assumed available. Every later stage gets cheaper from that point, and none of that is visible in the exfiltration entry. - *The stages this attacker did not reach.* With read-only credentials there is no write back into the registry — no shipping altered parameters into production — and no write into the corpus, so no poisoning at the next training run. Saying so explicitly is part of the answer: the vantage bounds the stage list. ## Why the vocabulary gap matters operationally Narrate this whole campaign in enterprise techniques and it reads as *credential theft plus file exfiltration*, which is a real finding and an incomplete one. The part that mattered — that an internal document-search service can now be studied offline by someone holding its encoder, and that its endpoint was already being measured — has no cell, so it never reaches the reader. That shapes what the defender does next. From the enterprise narration you get credential rotation, registry access review and egress monitoring: all correct, none sufficient. From the ML stages you also get query analytics on the endpoint, integrity checks on what the registry serves, and a decision about whether an encoder that has left the building should be rotated the way a key would be. Those actions do not fall out of "exfiltration". ## The two mistakes this question separates The first is treating the ML knowledge base as a reskin: it collapses the second list into the first and loses everything that made the incident an ML incident. The second is the mirror image — treating every step as exotic and refusing to map the parts that map, which produces a report the rest of the security organisation cannot read or compare with anything else it handles. The correct posture is deliberately two-sided. Map what maps, name what does not, and say in one sentence what the unmapped part changed about the attacker's position. In the literature the ML-specific stages live in MITRE ATLAS; the point for an interview is not the name but the ability to say *which* steps needed it and why the others did not. ## A common misreading of the copied file Candidates often say a stolen encoder means stolen training data. It does not. Parameters are what the model learned, not the records it learned from; whether anything about individual records can be drawn back out of a model is a separate question with its own preconditions and its own literature. Keep the finding precise: what left is behaviour, in a form that can be studied without paying for another query.