From a9bb38a107bcbdf7550612fe86a0013abba885bb Mon Sep 17 00:00:00 2001
From: Lukas Pirch <37810236+LPirch@users.noreply.github.com>
Date: Wed, 6 May 2026 08:41:18 +0200
Subject: [PATCH] fix: correct T-PERSIST-003 ATLAS mapping

Corrects the ATLAS ID/name for agent configuration tampering.
---
 threats.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/threats.yaml b/threats.yaml
index b75f93f..aef280b 100644
--- a/threats.yaml
+++ b/threats.yaml
@@ -304,7 +304,7 @@ threats:
   - id: T-PERSIST-003
     name: Agent Configuration Tampering
     tactic: Persistence
-    atlas: AML.T0010.002
+    atlas: AML.T0081
     risk: Medium
     category: persistence
     description: Attacker modifies agent configuration to persist access
@@ -847,8 +847,8 @@ atlas_technique_mapping:
   - atlas_id: AML.T0010.001
     name: "Supply Chain: AI Software"
     threats: [T-ACCESS-004, T-ACCESS-005, T-EXEC-005, T-PERSIST-001, T-PERSIST-002]
-  - atlas_id: AML.T0010.002
-    name: "Supply Chain: Data"
+  - atlas_id: AML.T0081
+    name: "Modify AI Agent Configuration"
     threats: [T-PERSIST-003]
   - atlas_id: AML.T0031
     name: Erode AI Model Integrity