agent-threat-rules 3.5.5 → 3.5.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +3 -2
- package/rules/agent-manipulation/ATR-2026-00032-goal-hijacking.yaml +1 -1
- package/rules/context-exfiltration/ATR-2026-00201-credential-pipe-exfiltration.yaml +1 -1
- package/rules/context-exfiltration/ATR-2026-00524-claude-code-anthropic-base-url-credential-exfil.yaml +1 -1
- package/rules/context-exfiltration/ATR-2026-00566-librechat-is-a-chatgpt-clone-with-additi.yaml +1 -1
- package/rules/context-exfiltration/ATR-2026-00569-agent-mcp-path-traversal-arbitrary-file-access.yaml +1 -1
- package/rules/context-exfiltration/ATR-2026-00571-xss-in-agent-mcp-rendered-output.yaml +1 -1
- package/rules/context-exfiltration/ATR-2026-00574-semantic-paraphrased-context-extraction.yaml +1 -1
- package/rules/data-poisoning/ATR-2026-00570-sql-injection-in-agent-tool-query.yaml +1 -1
- package/rules/excessive-autonomy/ATR-2026-00051-resource-exhaustion.yaml +1 -1
- package/rules/privilege-escalation/ATR-2026-00040-privilege-escalation.yaml +0 -33
- package/rules/privilege-escalation/ATR-2026-00204-stealth-execution-persistence.yaml +1 -1
- package/rules/privilege-escalation/ATR-2026-00539-crewai-codeinterpreter-sandbox-escape-rce.yaml +1 -1
- package/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml +1 -1
- package/rules/privilege-escalation/ATR-2026-00547-crewai-rag-url-ssrf-bypass.yaml +1 -1
- package/rules/prompt-injection/ATR-2026-00003-jailbreak-attempt.yaml +1 -1
- package/rules/prompt-injection/ATR-2026-00005-multi-turn-injection.yaml +1 -1
- package/rules/prompt-injection/ATR-2026-00203-context-pollution-skill-description.yaml +1 -1
- package/rules/prompt-injection/ATR-2026-00535-windsurf-ide-zero-click-prompt-injection.yaml +1 -1
- package/rules/prompt-injection/ATR-2026-00554-langchain-vulnerable-to-template-injecti.yaml +1 -1
- package/rules/prompt-injection/ATR-2026-00565-the-llm-cli-tool-thru-0-27-1-contains-a-.yaml +1 -1
- package/rules/prompt-injection/ATR-2026-00573-semantic-paraphrased-injection.yaml +1 -1
- package/rules/skill-compromise/ATR-2026-00060-skill-impersonation.yaml +0 -4
- package/rules/skill-compromise/ATR-2026-00523-claude-code-hooks-session-start-pre-trust-rce.yaml +1 -1
- package/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml +1 -1
- package/rules/tool-poisoning/ATR-2026-00532-apache-doris-mcp-sql-injection.yaml +1 -1
- package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml +1 -1
- package/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml +1 -1
- package/rules/tool-poisoning/ATR-2026-00536-nginx-ui-mcp-unauthenticated-command-execution.yaml +1 -1
- package/rules/tool-poisoning/ATR-2026-00561-fastmcp-vulnerable-to-windows-command-in.yaml +1 -1
- package/rules/tool-poisoning/ATR-2026-00567-mcp-stdio-config-command-injection.yaml +1 -1
- package/rules/tool-poisoning/ATR-2026-00568-agent-ssrf-cloud-metadata-file-inclusion.yaml +1 -1
- package/rules/tool-poisoning/ATR-2026-00572-symjack-symlink-config-redirection.yaml +1 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "agent-threat-rules",
|
|
3
|
-
"version": "3.5.
|
|
3
|
+
"version": "3.5.6",
|
|
4
4
|
"mcpName": "io.github.Agent-Threat-Rule/agent-threat-rules",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"description": "Open detection standard -- like Sigma, but for AI agents. 683 rules for prompt injection, tool poisoning, context exfiltration, and MCP attacks. Shipped in Cisco AI Defense. 97.2% recall on NVIDIA garak.",
|
|
@@ -86,7 +86,8 @@
|
|
|
86
86
|
"compile:yara": "tsx scripts/compile-yara.ts --all rules/",
|
|
87
87
|
"prepublishOnly": "npm run build",
|
|
88
88
|
"prepare": "npm run build 1>&2",
|
|
89
|
-
"compile:pipelock": "tsx scripts/compile-pipelock.ts"
|
|
89
|
+
"compile:pipelock": "tsx scripts/compile-pipelock.ts",
|
|
90
|
+
"reconcile-stats": "node scripts/reconcile-rule-count.mjs"
|
|
90
91
|
},
|
|
91
92
|
"dependencies": {
|
|
92
93
|
"@modelcontextprotocol/sdk": "^1.12.0",
|
|
@@ -91,35 +91,6 @@ agent_source:
|
|
|
91
91
|
- any
|
|
92
92
|
detection:
|
|
93
93
|
conditions:
|
|
94
|
-
- field: tool_name
|
|
95
|
-
operator: regex
|
|
96
|
-
value: (?i)(?:exec|execute|shell|bash|cmd|terminal|subprocess|os_command|system_call|run_command|powershell)
|
|
97
|
-
description: System shell or command execution tool invocation
|
|
98
|
-
- field: tool_name
|
|
99
|
-
operator: regex
|
|
100
|
-
value: (?i)(?:modify_permissions?|grant_access|elevate|set_role|change_acl|chmod|chown|sudo|setuid|setgid)
|
|
101
|
-
description: Permission modification or privilege elevation tools
|
|
102
|
-
- field: tool_name
|
|
103
|
-
operator: regex
|
|
104
|
-
value: (?i)(?:create_user|delete_user|modify_user|reset_password|manage_roles?|assign_role|revoke_role|add_admin)
|
|
105
|
-
description: User management and role assignment operations
|
|
106
|
-
- field: tool_name
|
|
107
|
-
operator: regex
|
|
108
|
-
value: (?i)(?:drop_(?:database|table|index)|truncate_table|alter_schema|create_database|db_admin|migrate_database)
|
|
109
|
-
description: Database administration and schema operations
|
|
110
|
-
- field: tool_name
|
|
111
|
-
operator: regex
|
|
112
|
-
value: >-
|
|
113
|
-
(?i)(?:update_config|modify_settings|change_environment|set_env|deploy|restart_service|stop_service|kill_process)
|
|
114
|
-
description: System configuration and service management operations
|
|
115
|
-
- field: tool_name
|
|
116
|
-
operator: regex
|
|
117
|
-
value: (?i)(?:manage_firewall|update_security_group|modify_iam|create_api_key|rotate_secret|manage_certificates?)
|
|
118
|
-
description: Security infrastructure management operations
|
|
119
|
-
- field: tool_name
|
|
120
|
-
operator: regex
|
|
121
|
-
value: (?i)(?:access_audit_log|clear_logs?|purge_logs?|modify_audit|disable_(?:monitoring|logging|alerting))
|
|
122
|
-
description: Audit tampering and monitoring evasion operations
|
|
123
94
|
- field: tool_args
|
|
124
95
|
operator: regex
|
|
125
96
|
value: >-
|
|
@@ -137,10 +108,6 @@ detection:
|
|
|
137
108
|
operator: regex
|
|
138
109
|
value: (?i)(?:kubectl\s+exec|kubectl\s+(?:create|apply)\s+.*(?:clusterrole|rolebinding)|kubectl\s+auth\s+can-i)
|
|
139
110
|
description: Kubernetes privilege escalation commands
|
|
140
|
-
- field: tool_name
|
|
141
|
-
operator: regex
|
|
142
|
-
value: (?i)(?:write_file|delete_file|rm\s+-rf|remove_directory|format_disk|wipe)
|
|
143
|
-
description: Destructive file system operations
|
|
144
111
|
- field: tool_args
|
|
145
112
|
operator: regex
|
|
146
113
|
value: (?i)(?:chmod\s+(?:[2467][0-7]{3}|[0-7]{0,3}7[0-7]{0,2})|chmod\s+[ug]\+s|chown\s+root|setcap\s+)
|
|
@@ -110,10 +110,6 @@ detection:
|
|
|
110
110
|
value: >-
|
|
111
111
|
(?i)(?:web[-_]?search|google[-_]?search|bing[-_]?search)[-_]?(?:v2|v3|pro|enhanced|premium|fast|turbo|plus|ultra|new)
|
|
112
112
|
description: Fake enhanced versions of known search tools
|
|
113
|
-
- field: tool_name
|
|
114
|
-
operator: regex
|
|
115
|
-
value: (?i)(?:exec|execute|run|shell)[-_]?(?:cmd|command|script|code)[-_]?(?:safe|secure|sandbox|trusted|verified)?
|
|
116
|
-
description: Shell execution tools with deceptive safety suffixes
|
|
117
113
|
- field: tool_name
|
|
118
114
|
operator: regex
|
|
119
115
|
value: >-
|