agent-threat-rules 3.4.0 → 3.5.0

package/rules/tool-poisoning/ATR-2026-01307-mcp-dns-rebinding-attack.yaml

@@ -29,7 +29,7 @@ references:
     - "ASI09:2026 - Insufficient Sandboxing"
     - "ASI04:2026 - Privilege Escalation via Agent"
   mitre_atlas:
-    - "AML.T0051.001 - Indirect Prompt Injection"
+    - "AML.T0051.001 - Indirect"
   cve:
     - "DNS rebinding attack class — SSRF via DNS temporal binding"
 

package/rules/tool-poisoning/ATR-2026-01310-mcp-tool-description-compliance-history-exfil.yaml

@@ -29,8 +29,8 @@ references:
     - "ASI03:2026 - Tool Misuse"
     - "ASI08:2026 - Data Leakage via Agent Actions"
   mitre_atlas:
-    - "AML.T0051.001 - Indirect Prompt Injection"
-    - "AML.T0053 - LLM Plugin Compromise"
+    - "AML.T0051.001 - Indirect"
+    - "AML.T0053 - AI Agent Tool Invocation"
 
 compliance:
   nist_ai_rmf:

package/rules/tool-poisoning/ATR-2026-01775-semantic-mcp-tool-manifest-poisoning.yaml

@@ -41,9 +41,10 @@ references:
     - "ASI03:2026 - Tool Misuse"
     - "ASI02:2026 - Unauthorized Actions"
   mitre_atlas:
-    - "AML.T0053 - LLM Plugin Compromise"
-    - "AML.T0019 - Publish Poisoned Artifacts"
-    - "AML.T0051.001 - Indirect Prompt Injection"
+    - "AML.T0053 - AI Agent Tool Invocation"
+    - "AML.T0019 - Publish Poisoned Datasets"
+    - "AML.T0051.001 - Indirect"
+    - "AML.T0110 - AI Agent Tool Poisoning"
 
 compliance:
   nist_ai_rmf:

package/rules/tool-poisoning/ATR-2026-01927-mcp-server-kubernetes-kubectl-command-injection.yaml

@@ -24,8 +24,8 @@ references:
   - "ASI02:2026 - Tool Misuse and Exploitation"
   - "ASI05:2026 - Unexpected Code Execution"
   mitre_atlas:
-  - "AML.T0053 - LLM Plugin Compromise"
-  - "AML.T0051.001 - Indirect Prompt Injection"
+  - "AML.T0053 - AI Agent Tool Invocation"
+  - "AML.T0051.001 - Indirect"
   cve:
   - CVE-2025-53355
   cwe:

package/rules/tool-poisoning/ATR-2026-01928-framelink-figma-mcp-curl-fallback-command-injection.yaml

@@ -25,8 +25,8 @@ references:
   - "ASI02:2026 - Tool Misuse and Exploitation"
   - "ASI05:2026 - Unexpected Code Execution"
   mitre_atlas:
-  - "AML.T0053 - LLM Plugin Compromise"
-  - "AML.T0051.001 - Indirect Prompt Injection"
+  - "AML.T0053 - AI Agent Tool Invocation"
+  - "AML.T0051.001 - Indirect"
   cve:
   - CVE-2025-53967
   cwe:

package/spec/mappings/atr-to-nist-csf-2.0.md

@@ -1,10 +1,10 @@
 # ATR → NIST Cybersecurity Framework 2.0 Mapping
 
-Version: 1.0.0
+Version: 1.1.0
 Status: Draft for NIST IR 8596 Informative Reference submission
-Date: 2026-05-28
+Date: 2026-06-14
 Editor: Adam Lin (林冠辛) <adam@agentthreatrule.org>
-Mapped corpus: Agent Threat Rules v3.0.x (449 rules / 10 categories)
+Mapped corpus: Agent Threat Rules v3.4.0 (651 rules / 10 categories; per data/stats.json 2026-06-14)
 Reference framework: NIST CSF 2.0 (NIST CSWP 29, February 2024)
 
 ---
@@ -55,7 +55,7 @@ Each ATR detection method contributes primarily to one or two CSF Functions:
 For each of the 10 ATR attack-class categories (SPEC.md §8), the table lists
 the CSF 2.0 subcategories the rule corpus supplies evidence for.
 
-### 4.1 prompt-injection (174 rules)
+### 4.1 prompt-injection (223 rules)
 
 | CSF 2.0 Subcategory | Outcome | ATR Evidence | Rules (examples) |
 |---------------------|---------|--------------|------------------|
@@ -63,7 +63,7 @@ the CSF 2.0 subcategories the rule corpus supplies evidence for.
 | DE.AE-02 | Potentially adverse events are analyzed to better understand associated activities | Each Rule's `detection.condition` produces a structured Match output (SPEC.md §7) with rule_id, severity, matched_selectors | All prompt-injection rules |
 | PR.IR-01 | Networks and environments are protected from unauthorized logical access and usage | `response.actions: [block_input]` enforces preventive control when Pattern matches | ATR-2026-00001, -00440, -00441 |
 
-### 4.2 tool-poisoning (43 rules)
+### 4.2 tool-poisoning (65 rules)
 
 | CSF 2.0 Subcategory | Outcome | ATR Evidence | Rules (examples) |
 |---------------------|---------|--------------|------------------|
@@ -71,7 +71,7 @@ the CSF 2.0 subcategories the rule corpus supplies evidence for.
 | ID.RA-08 | Processes for receiving, analyzing, and responding to vulnerabilities disclosed are established | CVE-mapped rules (CVE-2026-26030, CVE-2026-2275, CVE-2026-30617, ...) provide runtime detection for known tool-poisoning CVEs | ATR-2026-00529 (litellm SQL), -00538 (langchain-chatchat), -00543 (litellm MCP argv) |
 | PR.IR-01 | Networks/environments protected from unauthorized access | `block_tool` action prevents tool execution when poisoned MCP message detected | All tool-poisoning rules with `block_tool` |
 
-### 4.3 context-exfiltration (42 rules)
+### 4.3 context-exfiltration (103 rules)
 
 | CSF 2.0 Subcategory | Outcome | ATR Evidence | Rules (examples) |
 |---------------------|---------|--------------|------------------|
@@ -87,7 +87,7 @@ the CSF 2.0 subcategories the rule corpus supplies evidence for.
 | DE.AE-03 | Information is correlated from multiple sources | Trace rule 00552 correlates RETRIEVER / TOOL_RESPONSE pressure spans with AGENT goal-change spans | ATR-2026-00552 (goal drift, composite trace) |
 | GV.RM-01 | Cybersecurity risk management strategy is established | Authorization for autonomous goal changes requires policy; trace rules surface deviations | ATR-2026-00552 |
 
-### 4.5 privilege-escalation (18 rules)
+### 4.5 privilege-escalation (35 rules)
 
 | CSF 2.0 Subcategory | Outcome | ATR Evidence | Rules (examples) |
 |---------------------|---------|--------------|------------------|
@@ -95,14 +95,14 @@ the CSF 2.0 subcategories the rule corpus supplies evidence for.
 | PR.IR-01 | Unauthorized access protection | Cross-conversation memory write rule blocks tenant-boundary escapes | ATR-2026-00551 (forbid + cross-attribute, trace) |
 | GV.PO-01 | Policy for managing cybersecurity risks is established | Rules surface destructive autonomy that policy did not authorize | ATR-2026-00549, -00551 |
 
-### 4.6 excessive-autonomy (8 rules)
+### 4.6 excessive-autonomy (29 rules)
 
 | CSF 2.0 Subcategory | Outcome | ATR Evidence | Rules (examples) |
 |---------------------|---------|--------------|------------------|
 | GV.PO-01 | Policy for cybersecurity risks established | Rules detect runaway loops, resource exhaustion patterns | ATR-2026-00050, -00051 |
 | DE.AE-02 | Adverse events analyzed | Behavioral-method rules (placeholder in v1.1) will use metric thresholds over windows | (behavioral plane, §7 placeholder) |
 
-### 4.7 skill-compromise (43 rules)
+### 4.7 skill-compromise (45 rules)
 
 | CSF 2.0 Subcategory | Outcome | ATR Evidence | Rules (examples) |
 |---------------------|---------|--------------|------------------|
@@ -110,7 +110,7 @@ the CSF 2.0 subcategories the rule corpus supplies evidence for.
 | ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycle | Signature rules supply skill provenance binding | All signature-method rules in skill-compromise |
 | DE.CM-09 | Computing software monitored | Static skill scan (`scan_target: skill`) on every SKILL.md ingest | ATR-2026-00451, -00452 |
 
-### 4.8 model-abuse (10 rules)
+### 4.8 model-abuse (37 rules)
 
 | CSF 2.0 Subcategory | Outcome | ATR Evidence | Rules (examples) |
 |---------------------|---------|--------------|------------------|
@@ -124,7 +124,7 @@ the CSF 2.0 subcategories the rule corpus supplies evidence for.
 | PR.PS-04 | Log records are generated and made available for continuous monitoring | Model-security rules emit Match output for downstream SIEM consumption | ATR-2026-00433 (modelcache deserialization RCE) |
 | ID.RA-08 | Vulnerability disclosure processes | CVE-mapped model-security rules | ATR-2026-00433 |
 
-### 4.10 data-poisoning (2 rules)
+### 4.10 data-poisoning (5 rules)
 
 | CSF 2.0 Subcategory | Outcome | ATR Evidence | Rules (examples) |
 |---------------------|---------|--------------|------------------|