Skip to content
attack.paths
Connexion
← RegistryDossier · 5 steps · 4 edges

Indirect prompt injection via RAG document

Attacker uploads a poisoned document to a customer wiki / SharePoint that the LLM ingests at query time. Injection fires when a privileged user later asks a question that retrieves the doc.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target LLM features a RAG pipeline that pulls from a shared knowledge base (wiki, Drive, SharePoint, Confluence). Attacker has write access to that source (insider, public-share, vendor).

§ Steps

  1. 01
    Exfil via tool output to attacker channelExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Wait for a privileged query that retrieves itInitial Access
    T1078— Valid Accounts
  3. 03
    LLM follows attacker instructions from the docInitial Access
    AI-INDIRECT-INJECT— Indirect Prompt Injection (RAG / Web)
  4. 04
    Upload poisoned doc with hidden instructionsPersistence
    AI-RAG-POISON— RAG Index Poisoning
  5. 05
    Trigger tool calls (send email / read files)Execution
    AI-TOOL-ABUSE— Tool / Function-Call Abuse

§ References

§ Frequently asked

What is the "Indirect prompt injection via RAG document" attack path?
Attacker uploads a poisoned document to a customer wiki / SharePoint that the LLM ingests at query time. Injection fires when a privileged user later asks a question that retrieves the doc. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Exfil via tool output to attacker channel (T1041) — a exfiltration primitive. Assumed environment: target LLM features a RAG pipeline that pulls from a shared knowledge base (wiki, Drive, SharePoint, Confluence).
What is the final impact of this kill-chain?
The final step lands on Trigger tool calls (send email / read files) (AI-TOOL-ABUSE), which falls under Execution. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers