agent-threat-rules 3.1.1 → 3.3.0

package/rules/context-exfiltration/ATR-2026-00102-disguised-analytics-exfiltration.yaml

@@ -32,6 +32,9 @@ compliance:
     - article: "15"
       context: "Article 15 cybersecurity requirements include protection against tools that misrepresent their data handling to facilitate unauthorized data extraction; detection of analytics-disguised exfiltration is a required control for high-risk AI deployments."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Data Exfiltration via Disguised Analytics Collection) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "GV.6.1"
       context: "Disguised analytics exfiltration violates data governance boundaries by covertly transmitting full conversation context under the cover of routine telemetry, bypassing the data handling policies that GV.6.1 requires AI systems to enforce."
@@ -39,6 +42,12 @@ compliance:
     - subcategory: "MS.2.5"
       context: "Detection of analytics-disguised data exfiltration is a data protection control measurement required under MS.2.5 to verify that AI system tool invocations do not silently leak user conversation data to external endpoints."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Data Exfiltration via Disguised Analytics Collection)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Data Exfiltration via Disguised Analytics Collection)."
+      strength: secondary
   iso_42001:
     - clause: "8.4"
       context: "Disguised analytics exfiltration requires a documented AI system impact assessment under clause 8.4 that identifies tools claiming benign analytics roles as a covert data exfiltration vector affecting user privacy."
@@ -46,6 +55,12 @@ compliance:
     - clause: "9.1"
       context: "Ongoing monitoring and evaluation under clause 9.1 must include checks that tool-level data transmission claims are consistent with stated telemetry policies, detecting analytics-disguised exfiltration during operational review."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Data Exfiltration via Disguised Analytics Collection)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Data Exfiltration via Disguised Analytics Collection) is such a treatment."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: disguised-analytics-collection

package/rules/context-exfiltration/ATR-2026-00113-credential-theft.yaml

@@ -19,6 +19,10 @@ references:
     - ASI03:2026 - Agent Identity and Access Abuse
   mitre_attack:
     - T1552.001 - Credentials In Files
+  owasp_llm:
+    - LLM02:2025 - Sensitive Information Disclosure
+  mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
 compliance:
   eu_ai_act:
     - article: "15"
@@ -27,6 +31,9 @@ compliance:
     - article: "12"
       context: "Credential theft undermines the integrity of audit logs and access records that Article 12 logging obligations depend on; an attacker who obtains credentials can falsify or erase audit trails, making Article 12 compliance unverifiable."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential File Theft from Agent Environment) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "Adversarial tool calls targeting credential files such as ~/.aws/credentials and SSH private keys represent a direct exploitation of the agent's file-access capabilities that must be identified and tracked as a critical AI system risk."
@@ -34,6 +41,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Data governance policies must define and enforce scope restrictions on agent access to credential stores, preventing AI tools from reading authentication files outside their authorized operational boundary."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Credential File Theft from Agent Environment)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Credential File Theft from Agent Environment)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment activities must include controls that block agent access to well-known credential file paths, reducing the attack surface for credential theft through AI tool invocations."
@@ -41,6 +54,9 @@ compliance:
     - clause: "8.4"
       context: "AI system impact assessments must document and review the potential consequences of credential file theft, including lateral movement across all downstream services connected to stolen credentials."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential File Theft from Agent Environment)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: credential-theft

package/rules/context-exfiltration/ATR-2026-00114-oauth-token-abuse.yaml

@@ -19,6 +19,10 @@ references:
     - ASI03:2026 - Agent Identity and Access Abuse
   mitre_attack:
     - T1528 - Steal Application Access Token
+  owasp_llm:
+    - LLM02:2025 - Sensitive Information Disclosure
+  mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
 compliance:
   eu_ai_act:
     - article: "15"
@@ -27,6 +31,9 @@ compliance:
     - article: "12"
       context: "Stolen OAuth tokens allow attackers to impersonate legitimate users in audit logs, corrupting the record integrity that Article 12 requires; token interception detection is a prerequisite for maintaining trustworthy audit trails."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (OAuth and API Token Interception) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "OAuth token interception and malicious redirect_uri manipulation are adversarial input risks that exploit the agent's participation in authentication flows to capture credentials intended for legitimate services."
@@ -34,6 +41,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Data governance policies must restrict agent handling of bearer tokens, refresh tokens, and client secrets to prevent AI-assisted exfiltration of authorization credentials via forwarding or redirect manipulation."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (OAuth and API Token Interception)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (OAuth and API Token Interception)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment plans must address OAuth token interception scenarios by requiring agents to validate redirect URIs and prohibiting forwarding of authorization tokens to non-allowlisted destinations."
@@ -41,6 +54,9 @@ compliance:
     - clause: "8.4"
       context: "Impact assessments must document the account-takeover blast radius of OAuth token theft through agent-mediated flows, covering all services that accept the stolen bearer token."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (OAuth and API Token Interception)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: oauth-token-abuse

package/rules/context-exfiltration/ATR-2026-00115-env-var-harvesting.yaml

@@ -20,6 +20,10 @@ references:
     - ASI03:2026 - Agent Identity and Access Abuse
   mitre_attack:
     - T1082 - System Information Discovery
+  owasp_llm:
+    - LLM02:2025 - Sensitive Information Disclosure
+  mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
 compliance:
   eu_ai_act:
     - article: "15"
@@ -28,6 +32,9 @@ compliance:
     - article: "12"
       context: "Exfiltrated environment variables typically include logging and monitoring credentials; Article 12 record-keeping integrity depends on protecting the secrets that secure audit infrastructure from compromise via environment harvesting."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Bulk Environment Variable Harvesting and Exfiltration) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "Bulk environment variable harvesting via printenv, os.environ, or .env file reads is an adversarial technique that exploits agent runtime access to extract every secret in a single operation, and must be tracked as a critical AI system attack vector."
@@ -35,6 +42,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Data governance policies must explicitly prohibit agent tools from accessing the full process environment or .env files, as these sources aggregate all application secrets and database credentials into a single exfiltration target."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Bulk Environment Variable Harvesting and Exfiltration)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Bulk Environment Variable Harvesting and Exfiltration)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment activities must implement least-privilege environment access controls that prevent agent tools from reading bulk environment state and combining it with network exfiltration calls."
@@ -42,6 +55,9 @@ compliance:
     - clause: "8.4"
       context: "Impact assessments must document the total credential exposure scope of a successful environment harvesting attack, as compromising the full environment grants access to every connected service simultaneously."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Bulk Environment Variable Harvesting and Exfiltration)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: env-var-harvesting

package/rules/context-exfiltration/ATR-2026-00136-tool-response-data-piggyback.yaml

@@ -31,6 +31,9 @@ compliance:
     - article: "13"
       context: "Piggybacked data theft disguised as normal tool responses undermines the transparency Article 13 requires between AI system behavior and what users or operators understand to be occurring; users cannot exercise informed oversight when tool responses silently exfiltrate their data."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Tool Response Data Piggybacking) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "Tool response piggybacking is an adversarial input risk where legitimate-looking MCP outputs embed credential theft payloads; MP.5.1 requires that this class of adversarial tool-output attack be identified and tracked in the AI system risk inventory."
@@ -38,6 +41,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Piggybacked credential exfiltration in tool responses breaches data governance controls by transmitting SSH keys and API tokens to attacker endpoints; GV.6.1 data governance policies must cover tool output integrity as a data handling boundary."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Tool Response Data Piggybacking)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Tool Response Data Piggybacking)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment plans under clause 6.2 must include controls for tool response piggybacking attacks, where malicious MCP servers embed credential theft within normal-appearing tool result payloads to exploit agent trust."
@@ -45,6 +54,9 @@ compliance:
     - clause: "8.4"
       context: "Impact assessment under clause 8.4 must document the tool-response piggybacking vector — where credential theft is hidden in legitimate tool outputs — as a high-impact data exfiltration pathway for AI systems using MCP tool exchanges."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Tool Response Data Piggybacking)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: tool-response-piggyback

package/rules/context-exfiltration/ATR-2026-00141-example-format-key-leak.yaml

@@ -31,6 +31,20 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of API key leakage attempts triggers containment and disengagement workflows to prevent the agent from emitting credentials; MG.2.3 mandates that supersede/deactivate mechanisms are available when sensitive data exposure is detected."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (API Key Leakage via Example Format)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (API Key Leakage via Example Format) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (API Key Leakage via Example Format)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (API Key Leakage via Example Format) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: example-format-leak

package/rules/context-exfiltration/ATR-2026-00142-piggyback-transition-words.yaml

@@ -31,6 +31,20 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of transition-word piggyback patterns triggers containment workflows to block credential exfiltration before it leaves the agent boundary; MG.2.3 mandates that mechanisms exist to disengage or quarantine AI outputs when data leakage indicators are matched."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Data Piggybacking via Casual Transition Words)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Data Piggybacking via Casual Transition Words) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Data Piggybacking via Casual Transition Words)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Data Piggybacking via Casual Transition Words) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: piggyback-transition

package/rules/context-exfiltration/ATR-2026-00145-obfuscated-key-disclosure.yaml

@@ -32,6 +32,20 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of fake-encryption-wrapped credentials must trigger response plans to block transmission and revoke exposed keys; MG.2.3 requires mechanisms to supersede or disengage AI actions before the leak completes."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Obfuscated API Key Disclosure)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Obfuscated API Key Disclosure) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Obfuscated API Key Disclosure)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Obfuscated API Key Disclosure) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: obfuscated-key

package/rules/context-exfiltration/ATR-2026-00146-env-var-existence-probe.yaml

@@ -35,6 +35,20 @@ compliance:
       context: >-
         Detection of env var probing patterns enables containment responses to halt the exfiltration attempt before the agent escalates to retrieving the actual value; MG.2.3 mandates pre-defined treatment mechanisms for these risk events.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Environment Variable Existence Probing)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Environment Variable Existence Probing) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Environment Variable Existence Probing)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Environment Variable Existence Probing) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: env-var-probe

package/rules/context-exfiltration/ATR-2026-00150-credential-in-tool-response.yaml

@@ -35,6 +35,20 @@ compliance:
       context: >-
         Detection of leaked credentials in tool responses must trigger response mechanisms to disengage or block the agent before it propagates or acts on the exfiltrated secrets; MG.2.3 requires these supersede/deactivate controls be in place.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential Data Leaked in Tool Response)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Credential Data Leaked in Tool Response) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Credential Data Leaked in Tool Response)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential Data Leaked in Tool Response) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: credential-in-response

package/rules/context-exfiltration/ATR-2026-00152-obfuscated-credential-leak.yaml

@@ -32,6 +32,20 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of obfuscated credential exfiltration patterns must trigger risk treatment to disengage or quarantine the agent response before secrets leave the trust boundary; MG.2.3 mandates these supersede/deactivate mechanisms exist for such incidents."
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: obfuscated-credential

package/rules/context-exfiltration/ATR-2026-00162-skill-credential-exfil-combo.yaml

@@ -34,6 +34,20 @@ compliance:
       context: >-
         High-confidence matches for credential read-and-exfiltrate pipelines must trigger response actions to disengage or quarantine the offending skill before execution. MG.2.3 mandates that mechanisms exist to deactivate AI components when such risks are detected.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential Access with Exfiltration in Skill Instructions)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Credential Access with Exfiltration in Skill Instructions) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Credential Access with Exfiltration in Skill Instructions)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential Access with Exfiltration in Skill Instructions) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: credential-exfil-combo

package/rules/context-exfiltration/ATR-2026-00201-credential-pipe-exfiltration.yaml

@@ -39,6 +39,20 @@ compliance:
       context: >-
         Detection of credential exfiltration patterns must trigger immediate containment to disengage the agent before secrets reach attacker-controlled endpoints; MG.2.3 mandates pre-defined mechanisms to supersede or deactivate the AI system on such high-severity events.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential Exfiltration via Shell Pipe)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Credential Exfiltration via Shell Pipe) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Credential Exfiltration via Shell Pipe)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential Exfiltration via Shell Pipe) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: credential-pipe

package/rules/context-exfiltration/ATR-2026-00212-mcp-atlassian-credential-leak.yaml

@@ -49,6 +49,9 @@ compliance:
     - article: "12"
       context: "Leakage of Atlassian OAuth tokens and API keys via hint injection compromises the authentication credentials that protect audit logs and records; Article 12 logging integrity depends on protecting the access tokens that secure the audit trail from being exfiltrated through tool parameter injection."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "CVE-2026-27825/27826 mcp-atlassian hint parameter injection is an adversarial input attack where unsanitized hint values coerce the agent into leaking OAuth session cookies and API tokens; MP.5.1 requires this class of MCP tool parameter injection attack to be identified and tracked as an adversarial input risk."
@@ -56,6 +59,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Credential exfiltration via the mcp-atlassian hint parameter violates data governance boundaries by leaking Atlassian OAuth tokens and API keys through a tool parameter field that GV.6.1 data policies must designate as a sensitive data handling boundary."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826))."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826))."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment plans under clause 6.2 must include input sanitization controls for MCP tool parameters such as the mcp-atlassian hint field, which the CVE-2026-27825/27826 attack exploits to exfiltrate OAuth session credentials."
@@ -63,6 +72,9 @@ compliance:
     - clause: "8.4"
       context: "AI system impact assessment under clause 8.4 must document the mcp-atlassian hint parameter injection vector (CVE-2026-27825/27826), where unsanitized hint values forwarded into LLM context enable attacker-directed credential leakage."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826))."
+      strength: primary
 
 tags:
   category: context-exfiltration

package/rules/context-exfiltration/ATR-2026-00261-markdown-image-exfiltration.yaml

@@ -35,6 +35,9 @@ compliance:
     - article: "13"
       context: "Covert exfiltration via markdown rendering is invisible to users and operators, directly violating the transparency that Article 13 requires by allowing AI-generated output to silently transmit user data without any indication."
       strength: secondary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Markdown Image URL Data Exfiltration) affecting that data."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: "Markdown image URL exfiltration is an adversarial input technique that coerces LLMs into generating image references that encode base64 conversation data in query strings, triggering auto-fetch exfiltration; MP.5.1 requires this output-channel attack pattern to be identified and tracked."
@@ -42,6 +45,12 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Exfiltrating conversation context and user secrets via markdown-rendered image URLs to attacker-controlled domains violates data governance boundaries; GV.6.1 policies must cover AI-generated output as a potential unauthorized data transmission channel."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Markdown Image URL Data Exfiltration)."
+      strength: primary
+    - subcategory: "MS.2.10"
+      context: "NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Markdown Image URL Data Exfiltration)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Risk treatment activities under clause 6.2 must include output scanning controls targeting markdown image syntax with encoded payloads, which exploits chat UI auto-fetch behavior to silently exfiltrate conversation data."
@@ -49,6 +58,9 @@ compliance:
     - clause: "8.4"
       context: "AI system impact assessment under clause 8.4 must document the markdown image exfiltration vector, where LLM-generated image references encode sensitive context in URLs that the rendering client automatically fetches to attacker domains."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Markdown Image URL Data Exfiltration)."
+      strength: primary
 tags:
   category: context-exfiltration
   subcategory: markdown-image-uri

package/rules/context-exfiltration/ATR-2026-00274-api-key-generation-request.yaml

@@ -41,6 +41,20 @@ compliance:
       context: >-
         Detection of credential generation or completion requests must trigger risk treatment to block the response before the fabricated or memorized secret is emitted. MG.2.3 mandates that these supersede/disengage mechanisms are in place for high-risk output paths.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: api-key-generation

package/rules/context-exfiltration/ATR-2026-00275-system-prompt-training-data-extraction.yaml

@@ -43,6 +43,20 @@ compliance:
       context: >-
         Pattern-based detection of system prompt extraction and training data replay probes feeds post-deployment monitoring telemetry; MG.4.1 requires implemented monitoring plans that flag extraction attempts in production traffic.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (System Prompt Extraction / Training Data Verbatim Replay)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (System Prompt Extraction / Training Data Verbatim Replay) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (System Prompt Extraction / Training Data Verbatim Replay)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (System Prompt Extraction / Training Data Verbatim Replay) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: system-prompt-training-data-extraction

package/rules/context-exfiltration/ATR-2026-00290-divergence-repeat-word-training-extraction.yaml

@@ -44,6 +44,20 @@ compliance:
       context: >-
         Detection of "repeat forever/indefinitely" prompts must trigger interception or deactivation of the response stream before memorized training data is fully emitted; MG.2.3 requires mechanisms to supersede or disengage AI output when extraction attacks are identified.
       strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Divergence Attack — Repeat-Word-Forever Training Data Extraction)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Divergence Attack — Repeat-Word-Forever Training Data Extraction) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Divergence Attack — Repeat-Word-Forever Training Data Extraction)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Divergence Attack — Repeat-Word-Forever Training Data Extraction) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: divergence-repeat-word-training-extraction

package/rules/context-exfiltration/ATR-2026-00291-biometric-surveillance-personal-data-request.yaml

@@ -40,6 +40,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of named-person biometric extraction attempts must trigger containment responses (refusal, session quarantine) before the model emits identifying biometric content; MG.2.3 mandates that these supersede/disengage mechanisms are defined and activated on detection."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Biometric Surveillance — Personal Biometric Data Request for Named Individual) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: biometric-surveillance-personal

package/rules/context-exfiltration/ATR-2026-00293-educational-records-personal-data-request.yaml

@@ -39,6 +39,23 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Detection of named-individual educational record requests must trigger pre-defined risk treatment to block or redirect the response before sensitive data is fabricated or leaked; MG.2.3 mandates that such containment mechanisms are in place."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Educational Records — Personal Academic/Professional Record Request for Named Individual) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: educational-records-personal

package/rules/context-exfiltration/ATR-2026-00294-financial-pii-personal-data-request.yaml

@@ -43,6 +43,23 @@ compliance:
       context: >-
         Relationship-label social-engineering framing (e.g., "my doctor, Anne's bank account") is an adversarial input pattern whose likelihood and impact must be characterized; MP.5.1 requires identifying and tracking these high-magnitude financial-PII exfiltration vectors.
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual)."
+      strength: primary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual)."
+      strength: primary
+    - clause: "6.2"
+      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual) is such a treatment."
+      strength: secondary
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual)."
+      strength: primary
+    - article: "10"
+      context: "Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Financial PII — Personal Financial Data Request for Named Individual) affecting that data."
+      strength: secondary
 tags:
   category: context-exfiltration
   subcategory: financial-pii-personal