agent-threat-rules 4.0.0 → 4.2.0

package/rules/context-exfiltration/ATR-2026-02684-modern-credential-store-file-argument.yaml

@@ -0,0 +1,104 @@
+title: File-Tool Argument Targets a Modern Credential Store Outside the Classic Path List
+id: ATR-2026-02684
+rule_version: 2
+status: experimental
+description: |
+  Detects a file-reading / file-attaching agent tool argument whose value names a credential store that ATR's existing sensitive-path rules do not list. Those rules (ATR-2026-02250, ATR-2026-00161 and the tool_call traversal family) were written around the 2010s-era set -- ~/.ssh/id_*, ~/.aws/credentials, ~/.netrc, ~/.kube/config, /etc/shadow, /proc/self/environ -- and stop there. The stores an agent actually finds on a 2026 developer or CI box are elsewhere: ~/.config/gh/hosts.yml (a GitHub token with repo scope), /var/run/secrets/kubernetes.io/serviceaccount/token (a live cluster identity), ~/.config/gcloud/*, ~/.pypirc, ~/.cargo/credentials, ~/.terraform.d/ credentials.tfrc.json, ~/.azure/*, ~/.config/rclone/rclone.conf, ~/.docker/config.json, ~/.npmrc. Mined from OWASP-ASI-INC-09330 (OpenClaw canvas path traversal), where the decisive evidence is exactly a file-path tool argument naming one of these. rule_version 2 (adversarial refutation, 2026-08-24): version 1 required only that a file-shaped argument NAME sit next to the path, and it accepted the bare words `path` and `file` as that name. Those are ordinary English words and also the two most common keys in DevOps configuration, so 15 of 16 hand-written benign inputs fired -- `rclone config paths` output, an actions/cache step, a docker-compose secret, an Ansible stat task, Kubernetes and Terraform documentation, an incident postmortem, a pytest failure line, and security writing explaining this very attack. The rule now requires one of four serialized-call shapes: a quoted argument key AND a quoted value; an agent-internal argument name (jsonlPath, systemPromptFile, personaFile ...); a function call whose CALLEE is a named file tool; or a tool call that names a file-reading tool and passes a generic path argument inside the same call. Prose, YAML configuration and CLI output no longer qualify.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cwe:
+    - CWE-522
+    - CWE-538
+    - CWE-22
+  owasp_llm:
+    - LLM02:2025
+    - LLM06:2025
+  owasp_agentic:
+    - ASI04:2026
+    - ASI05:2026
+  mitre_attack:
+    - T1552.001 - Credentials In Files
+    - T1528 - Steal Application Access Token
+  mitre_atlas:
+    - AML.T0055 - Unsecured Credentials
+  external:
+    - https://owasp.org/www-project-agentic-security-initiative/
+    - https://kubernetes.io/docs/tasks/run-application/access-api-from-pod/
+metadata_provenance:
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires protection against unauthorised access to system assets; this rule detects agent file-tool arguments aimed at credential stores.
+      strength: primary
+    - article: '10'
+      context: Article 10 (data and data governance) is supported by preventing credential material from being pulled into the agent's context as if it were ordinary data.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Credential theft through agent file tools is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing modern credential-store exposure through agent tooling in the organizational AI risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by screening file-tool arguments against a credential-store list.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by alerting when an agent tool is pointed at a token store.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: modern-credential-store-read
+  scan_target: agent
+  confidence: high
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)["\x27](?:file_?path|filepath|file_?name|jsonl_?path|artifact_?path|agent_?file|instructions_?file_?path|system_?prompt_?file|prompt_?file|persona_?file|source_?file|input_?file|attachments?)["\x27]\s{0,4}[:=]\s{0,4}["\x27](?:~|\$HOME|/home/[\w.-]{1,24}|/Users/[\w.-]{1,24})?/?\.?(?:config/gh/hosts\.ya?ml|config/gcloud/(?:credentials\.db|application_default_credentials\.json|legacy_credentials)|config/rclone/rclone\.conf|pypirc|cargo/credentials(?:\.toml)?|terraform\.d/credentials\.tfrc\.json|azure/(?:accessTokens\.json|msal_token_cache\.json)|(?:var/)?run/secrets/kubernetes\.io/serviceaccount/(?:token|namespace|ca\.crt))\b
+      description: 'JSON/dict tool-call shape: a QUOTED file-shaped argument key whose QUOTED value is a modern credential store -- GitHub CLI host tokens, gcloud credential databases, rclone remotes, PyPI upload credentials, cargo registry tokens, Terraform Cloud tokens, Azure token caches, or the in-pod Kubernetes service-account token. Both the key and the value must be quote-delimited, which is what a serialized tool call looks like and what DevOps YAML, CLI output and prose do not.'
+    - field: content
+      operator: regex
+      value: (?i)\b(?:jsonl_?path|artifact_?path|agent_?file|instructions_?file_?path|system_?prompt_?file|prompt_?file|persona_?file)\s{0,4}[:=]\s{0,4}["\x27]?(?:~|\$HOME|/home/[\w.-]{1,24}|/Users/[\w.-]{1,24})?/?\.?(?:config/gh/hosts\.ya?ml|config/gcloud/(?:credentials\.db|application_default_credentials\.json|legacy_credentials)|config/rclone/rclone\.conf|pypirc|cargo/credentials(?:\.toml)?|terraform\.d/credentials\.tfrc\.json|azure/(?:accessTokens\.json|msal_token_cache\.json)|(?:var/)?run/secrets/kubernetes\.io/serviceaccount/(?:token|namespace|ca\.crt))\b
+      description: Agent-internal argument names (jsonlPath, artifactPath, systemPromptFile, personaFile, promptFile, agentFile, instructionsFilePath) pointed at a credential store. These names do not occur in ordinary infrastructure config, so the quoting requirement is relaxed here.
+    - field: content
+      operator: regex
+      value: (?i)\b(?:read_file|readfile|read_text_file|write_file|attach_file|upload_file|send_file|get_file|load_file|open_file|append_file)\s{0,4}\(\s{0,4}(?:path|file|file_?path|file_?name|filepath|src|source|attachments?)\s{0,4}=\s{0,4}["\x27](?:~|\$HOME|/home/[\w.-]{1,24}|/Users/[\w.-]{1,24})?/?\.?(?:config/gh/hosts\.ya?ml|config/gcloud/(?:credentials\.db|application_default_credentials\.json|legacy_credentials)|config/rclone/rclone\.conf|pypirc|cargo/credentials(?:\.toml)?|terraform\.d/credentials\.tfrc\.json|azure/(?:accessTokens\.json|msal_token_cache\.json)|(?:var/)?run/secrets/kubernetes\.io/serviceaccount/(?:token|namespace|ca\.crt))\b
+      description: Function-call form where the CALLEE is a named file tool -- read_file(path="..."), attach_file(file="...") -- and the argument value is a credential store. The callee list is what separates this from os.stat(path=...) or shutil.copy(src=...) in ordinary code.
+    - field: content
+      operator: regex
+      value: (?i)["\x27](?:tool|tool_?name|function|name)["\x27]\s{0,4}:\s{0,4}["\x27](?:read|read_file|readfile|read_text_file|read_many_files|cat|view|open|open_file|attach|attach_file|upload|upload_file|send_file|get_file|load_file|fetch_file|file_read)["\x27][^\n]{0,160}["\x27](?:path|file|file_?path|file_?name|filepath|src|source|attachments?)["\x27]\s{0,4}:\s{0,4}["\x27](?:~|\$HOME|/home/[\w.-]{1,24}|/Users/[\w.-]{1,24})?/?\.?(?:config/gh/hosts\.ya?ml|config/gcloud/(?:credentials\.db|application_default_credentials\.json|legacy_credentials)|config/rclone/rclone\.conf|pypirc|cargo/credentials(?:\.toml)?|terraform\.d/credentials\.tfrc\.json|azure/(?:accessTokens\.json|msal_token_cache\.json)|(?:var/)?run/secrets/kubernetes\.io/serviceaccount/(?:token|namespace|ca\.crt))\b
+      description: 'Serialized tool call that names a file-reading tool and, within the same call, passes a generic path/file/src argument whose value is a credential store. Requiring the tool name is what keeps an Ansible task, a docker-compose secret or a backup manifest -- all of which carry a bare path:/file: key -- out of this condition.'
+  false_positives:
+    - 'ADVERSARIAL, 2026-08-24 refutation pass: rule_version 1 fired on 15 of 16 benign probes. Root cause: `path` and `file` were accepted as argument names, and they are ordinary English words as well as the most common keys in Kubernetes, Ansible, docker-compose and GitHub Actions YAML. All 15 are now recorded as true_negatives.'
+    - 'RESIDUAL, accepted: a security article that reproduces the verbatim JSON payload ({"tool":"read_file","arguments":{"file_path":"~/.config/gh/hosts.yml"}}) still matches. Those are the same bytes as the attack and no pattern can separate them; the same limit is accepted by ATR-2026-02660-class rules.'
+    - An incident-response runbook or troubleshooting note that names one of these paths in prose or in a bare `cat` command -- the path must be the value of a file-shaped argument, or the source of an upload
+    - A legitimate CI step that reads its own ~/.npmrc or ~/.docker/config.json as part of publishing, written as a shell command rather than as a file-tool argument
+    - Documentation listing where each tool stores its configuration (e.g. 'gh stores tokens in ~/.config/gh/hosts.yml')
+    - A tool argument pointed at a non-credential file inside the same directory, e.g. path=~/.config/gh/config.yml (settings, not hosts.yml)
+    - 'ADVERSARIAL, FIXED: a verb-gated second condition (upload/attach/-F file=@ near one of these paths) was written first and then DELETED. It fired on 8 of 11 hand-written benign twins -- every one of them a security-policy sentence such as ''never upload ~/.config/gh/hosts.yml to a support ticket''. Prose about the attack and the attack itself share the verb, so only the argument-assignment form is matched now.'
+    - 'ADVERSARIAL, FIXED: a CI setup step writing ~/.npmrc or ~/.docker/config.json through write_file matched the first version of this rule. Both were removed from the list because a legitimate write and a credential read are indistinguishable at this layer. The remaining stores can still match on a write; that is accepted, because an agent writing someone''s gcloud or Terraform credential file is itself worth an alert.'
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02684] A file tool argument names a credential store (GitHub CLI, gcloud, Kubernetes service account, PyPI, cargo, Terraform, Azure, rclone, Docker or npm auth). Reading it pulls a live bearer credential into the agent's context.
+confidence: 82

package/rules/context-exfiltration/ATR-2026-02703-sql-server-side-file-and-program-primitive.yaml

@@ -0,0 +1,86 @@
+title: Agent-Generated SQL Reaches Outside the Database via COPY TO PROGRAM or a Server-Side File Read
+id: ATR-2026-02703
+rule_version: 2
+status: experimental
+description: |
+  Detects SQL, produced by the model or carried in an agent event, that uses a database engine's escape hatches into the host: PostgreSQL `COPY ... TO PROGRAM '<cmd>'` (pipes a result set into a shell command), and `pg_read_file` / `pg_read_binary_file` / `pg_stat_file` / `lo_import` called on a path that traverses out of the data directory or names a credential file. Mined from GHSA-pmch-g965-grmr (Langroid SQLChatAgent), whose `_validate_query` blocklist stopped the obvious DML verbs and missed the `pg_read_file` family entirely, turning a natural-language question into an arbitrary server-side file read. ATR already covers the ingest direction -- ATR-2026-01987 matches `COPY ... FROM PROGRAM` and `INTO OUTFILE` -- but verified on the shipped engine, the exfiltration direction (`COPY orders TO PROGRAM 'nc ...'`) and the whole pg_read_file family match nothing.
+  ADVERSARIAL REVIEW 2026-08-24 -- THREE CORRECTIONS, ALL MEASURED. Sixteen benign samples were run through the shipped engine against rule_version 1 across llm_input, llm_output, tool_call, tool_response and mcp_exchange. ALL SIXTEEN FIRED. What changed: (1) THE ABSOLUTE-PATH HANDLE WAS WRONG. Version 1 claimed an absolute path separates attack from DBA work. It does not: members of pg_read_server_files legitimately pass absolute paths, and pg_read_file('/var/log/postgresql/postgresql-16-main.log', 0, 200000) and pg_stat_file('/etc/postgresql/16/main/postgresql.conf') are ordinary operations that both fired. The handle is now the TARGET, not the shape: a traversal, or a named credential file (.pgpass, .ssh/, /etc/passwd, /etc/shadow, .aws/credentials, .env, authorized_keys, /proc/.../environ). lo_import was narrowed the same way -- version 1 fired on the migration SELECT lo_import('/opt/acme/assets/logo.png'). (2) TO PROGRAM NOW REQUIRES THE QUOTE THE SYNTAX REQUIRES. Version 1's bare word-boundary form fired on every Windows install instruction of the shape "copy the signed binary to Program Files/Acme/bin" -- six of the sixteen benign samples, including a CI build log, a changelog, an Ansible task and a Traditional Chinese deployment runbook. COPY ... TO PROGRAM is always followed by a quoted command string, so requiring it costs no recall. (3) THE OPENDATASOURCE ARM WAS REMOVED, NOT NARROWED. OPENDATASOURCE( is ordinary T-SQL: it is how a DBA pulls a one-off extract from an Excel file or another instance, and it is also the function a hardening checklist names when telling you to switch Ad Hoc Distributed Queries off. Both fired. No precision handle survives inspection: requiring an inline Password= does not work, because Microsoft's own OPENDATASOURCE reference example is 'Data Source=Seattle1;User ID=MyUID;Password=MyPass'. An arm that cannot separate the attack from the vendor's documentation of the feature is worse than no arm, so SQL Server ad-hoc distributed queries are now a stated non-goal of this rule.
+author: ATR Community (GHSA sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cwe:
+    - CWE-89
+    - CWE-73
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI05:2026
+  mitre_attack:
+    - T1005 - Data from Local System
+  mitre_atlas:
+    - AML.T0057 - LLM Data Leakage
+  external:
+    - https://github.com/advisories/GHSA-pmch-g965-grmr
+metadata_provenance:
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires protection against unauthorised access to data; this rule detects agent-generated SQL that reads host files or pipes query results into a shell command.
+      strength: primary
+    - article: '10'
+      context: Article 10 (data and data governance) expects data handled by the system to stay within its governed scope; a COPY TO PROGRAM or pg_read_file call removes it from that scope.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Server-side file access through model-generated SQL is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing SQL blocklist bypass through non-DML file primitives as an AI-specific risk in the organizational risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by inspecting generated SQL for host-reaching primitives before execution.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented through runtime detection of the escape-hatch query.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: sql-host-escape-primitive
+  scan_target: runtime
+  confidence: high
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?:\bcopy\b[^;\r\n]{0,40}\bto\s{1,4}program\s{0,4}["\x27]|\b(?:pg_(?:read_file|read_binary_file|stat_file)|lo_import)\s{0,3}\(\s{0,3}["\x27][^"\x27\r\n]{0,90}(?:\.\./|/etc/(?:passwd|shadow|sudoers|ssh/)|\.pgpass|\.ssh/|authorized_keys|/proc/[\w./]{0,24}environ|/root/|\.aws/credentials|\.env\b|\.git-credentials))
+      description: COPY ... TO PROGRAM followed by the quoted command string the syntax requires, or a pg_read_file/pg_stat_file/lo_import call whose path argument traverses or names a credential file. NARROWED by adversarial review 2026-08-24 -- see false_positives.
+  false_positives:
+    - 'Routine DBA file access, relative or absolute: pg_read_file(''pg_hba.conf''), pg_read_file(''/var/log/postgresql/postgresql-16-main.log'', 0, 200000), pg_stat_file(''/etc/postgresql/16/main/postgresql.conf''), lo_import(''/opt/acme/assets/logo.png''). Version 1 fired on the last three; the condition now requires a traversal or a named credential target.'
+    - SQL Server ad-hoc distributed queries. OPENDATASOURCE( is no longer matched at all -- see correction (3) in the description. Separating linked-server abuse from a legitimate ad-hoc extract needs configuration state (is Ad Hoc Distributed Queries even enabled, and who is the caller) that a content regex does not have.
+    - 'KNOWN AND UNFIXABLE, MEASURED: security writing that quotes the payload verbatim still fires -- a GHSA write-up containing pg_read_file(''/etc/passwd''), an incident postmortem containing COPY (SELECT * FROM invoices) TO PROGRAM ''curl -T - http://...'', this rule''s own description, and a pytest that asserts the validator REJECTS agent.run_sql("SELECT pg_read_file(''/etc/passwd'')"). Four of the sixteen benign samples are in this class and all four still fire. A content rule cannot tell a quoted payload from the payload, which is why the response is alert-only. Prose that DISCUSSES the technique without the executable string is silent, and that was measured.'
+    - Any English, Chinese or shell instruction to copy something to a Program Files or program directory, because TO PROGRAM must be followed by the opening quote of the command string.
+    - COPY ... FROM PROGRAM and SELECT ... INTO OUTFILE, which are matched by ATR-2026-01987 and deliberately left out here to avoid duplicate alerting on the ingest direction.
+    - An ORM or migration file naming a column or function `lo_import` or `copy_to_program` without the call syntax and the required argument shape.
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02703] Generated SQL uses a database escape hatch to reach the host filesystem or a shell (COPY TO PROGRAM / pg_read_file on an absolute path / lo_import / OPENDATASOURCE). Validate generated SQL with an allowlist of statements, not a blocklist of verbs.
+confidence: 80

package/rules/context-exfiltration/ATR-2026-02847-policy-justified-exfil-to-email.yaml

@@ -0,0 +1,88 @@
+title: Policy-Justified Email Exfiltration Pretext Detection
+id: ATR-2026-02847
+rule_version: 1
+status: experimental
+description: |
+  Detects a social-engineering wrapper commonly used to coerce an agent into exfiltrating sensitive data or conversation content to an attacker-controlled email address. The pattern pairs a fabricated authority or compliance justification (per company/management policy or directive, a data retention policy, or a stated purpose such as quality assurance, verification, audit, or compliance) with a nearby email address that serves as the exfiltration destination. The technique is independent of the specific lookalike domain used and instead targets the reusable pretext-plus-destination structure that makes the instruction appear legitimate to the agent.
+author: ATR Community
+date: 2026/10/06
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM02:2025
+  owasp_agentic:
+    - ASI05:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+  mitre_attack:
+    - 'T1114.003 - Email Collection: Email Forwarding Rule'
+    - T1598 - Phishing for Information
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: High-risk AI systems must be resilient against manipulation that causes them to exfiltrate data under a fabricated policy pretext; detecting the policy-justified exfiltration-to-email pattern is a concrete cybersecurity control satisfying Article 15 robustness requirements.
+      strength: primary
+    - article: '9'
+      context: Policy-pretext exfiltration attempts are a documented risk class for agentic systems that process untrusted content; Article 9 requires runtime monitoring controls capable of detecting these attempts as part of the continuous risk management system.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MP.5.1
+      context: Fabricated-authority exfiltration pretexts are a primary class of adversarial social-engineering input against AI systems; MP.5.1 requires these adversarial input risks be identified and tracked so runtime detection controls like this rule can be deployed.
+      strength: primary
+    - subcategory: MG.3.2
+      context: Detected policy-justified exfiltration attempts require the risk monitoring and response procedures required by MG.3.2 to be triggered so that unauthorized data transfer to the destination address is contained.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational controls ensure AI systems execute consistently with their intended behavior; runtime detection of policy-justified exfiltration pretexts enforces that data handling constraints remain active despite adversarial instructions embedded in content.
+      strength: primary
+    - clause: '8.3'
+      context: Clause 8.3 requires ongoing evaluation of AI system performance against identified risks; this rule provides the detection evidence needed to evaluate and demonstrate control effectiveness against exfiltration-pretext attacks.
+      strength: secondary
+metadata_provenance:
+  source: false_negative_analysis
+  derivation: |
+    Pattern generalized from confirmed false-negative attack samples that pair a fabricated policy/compliance/audit justification with a nearby destination email address, independent of the specific lookalike domain used in each sample.
+  engineer_verified:
+    recovers: 22
+    benign_fp: 0
+  related_cluster: policy-justified-exfil-to-email
+tags:
+  category: context-exfiltration
+  subcategory: policy-justified-exfil-to-email
+  scan_target: mcp
+  confidence: high
+agent_source:
+  type: llm_io
+  framework:
+    - openai
+    - anthropic
+    - langchain
+    - llamaindex
+    - autogen
+    - crewai
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b[\s\S]{0,100}[\w.+-]+@[\w-]+\.[\w.-]+|[\w.+-]@[\w-]+\.[\w.-]+[\s\S]{0,100}\b(?:per\s+(?:company|management)\s+(?:policy|directive)|data\s+retention\s+policy|for\s+(?:quality\s+assurance|verification\s+purposes|audit\s+purposes|compliance\s+purposes))\b
+      description: Fabricated policy/compliance/audit pretext paired with a nearby destination email address, in either order
+  condition: any
+  false_positives:
+    - Legitimate internal notices citing company policy that do not reference any destination email address
+    - Customer support replies containing a contact email with unrelated surrounding text
+    - Compliance or audit documentation that discusses retention policy without instructing data be sent anywhere
+    - Quality assurance process descriptions that do not include a destination address
+response:
+  actions:
+    - alert
+    - snapshot
+    - escalate
+  auto_response_threshold: high
+  message_template: '[ATR-2026-02847] Policy-Justified Email Exfiltration Pretext Detection detected.'
+confidence: 90

package/rules/context-exfiltration/ATR-2026-02850-fake-documentation-forward-request.yaml

@@ -0,0 +1,80 @@
+title: Fake Documentation Pretext Data Exfiltration via Email
+id: ATR-2026-02850
+rule_version: 1
+status: experimental
+description: |
+  Detects attempts to exfiltrate captured or sensitive information by invoking a false "documentation", "records", or compliance pretext that instructs forwarding, transmitting, consolidating, or logging captured data to an external email address. This pattern recurs in phishing and social-engineering style injected content in both English and French, where attackers frame data transmission as routine internal record-keeping ("for our documentation", "for our records", "documentation and guidelines", "internal documentation", "pour notre documentation") immediately followed by a transmission verb ("forward", "transmit", "transmettre", "send", "consolidate", "log", "maintain") and an email address. Detection requires the pretext phrase, the transmission verb, and an email address within a bounded context window to minimize false positives on legitimate documentation references that do not instruct sending data anywhere.
+author: ATR Community
+date: 2026/10/06
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM02:2025
+  owasp_agentic:
+    - ASI09:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0057 - LLM Data Leakage
+  mitre_attack:
+    - T1566 - Phishing
+    - T1048 - Exfiltration Over Alternative Protocol
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: High-risk AI systems must be resilient against adversarial attempts to manipulate the system into exfiltrating data; detecting fake-documentation forwarding pretexts is a concrete cybersecurity control satisfying Article 15 requirements for robustness against input-based manipulation.
+      strength: primary
+    - article: '9'
+      context: Fake-documentation exfiltration pretexts constitute a documented risk class in the AI system risk register; Article 9 requires that monitoring controls are deployed to detect these attempts at runtime.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MP.5.1
+      context: Fake-documentation forwarding requests are a class of adversarial social-engineering input against AI systems; MP.5.1 requires that such adversarial input risks are identified and tracked so that runtime detection controls like this rule can be deployed.
+      strength: primary
+    - subcategory: MG.3.2
+      context: Detected fake-documentation exfiltration attempts require monitoring of third-party risks introduced through injected content that directs the system to transmit data externally, as required by MG.3.2.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational controls ensure AI systems execute correctly and consistently; runtime detection of fake-documentation exfiltration pretexts enforces that data-handling constraints remain active despite adversarial instructions to forward captured information externally.
+      strength: primary
+    - clause: '8.3'
+      context: Clause 8.3 requires AI systems to respond appropriately to issues throughout their lifecycle; this rule provides the detection event needed to trigger containment of an in-progress data exfiltration attempt.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: fake-documentation-forward-request
+  scan_target: mcp
+  confidence: high
+agent_source:
+  type: llm_io
+  framework:
+    - openai
+    - anthropic
+    - langchain
+    - llamaindex
+    - autogen
+    - crewai
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)\b(?:for\s+our\s+(?:documentation|records)|pour\s+notre\s+documentation|documentation\s+and\s+guidelines|internal\s+documentation)\b[\s\S]{0,100}\b(?:forward(?:ed|ing)?|transmit|transmettre|send(?:ing)?|consolidat\w*|logged?|maintained)\b[\s\S]{0,100}@[\w.-]{1,50}
+      description: Fake documentation/records pretext instructing forwarding, transmission, or logging of captured information to an email address
+  condition: any
+  false_positives:
+    - Legitimate references to internal documentation or recordkeeping that do not instruct sending data anywhere
+    - Compliance or HR documentation discussions that mention maintenance of records without an associated email transmission instruction
+    - Project documentation notes that happen to be near an unrelated email address in the same message
+response:
+  actions:
+    - alert
+    - snapshot
+    - escalate
+  auto_response_threshold: high
+  message_template: '[ATR-2026-02850] Fake Documentation Pretext Data Exfiltration via Email detected.'
+confidence: 90

package/rules/context-exfiltration/ATR-2026-02855-cross-email-exfil-relay.yaml

@@ -0,0 +1,79 @@
+title: Cross-Email Context Exfiltration Relay Detection
+id: ATR-2026-02855
+rule_version: 1
+status: experimental
+description: |
+  Detects cross-document exfiltration-chaining attempts in which a tool output or injected message instructs the agent to pull a value (e.g. a figure, credential, or identifier) out of an unrelated prior email or message in its context window and relay that value via an outbound send action to an attacker-controlled or unverified recipient. This is the core structural pattern of cross-email exfil relay: the agent is told that something was "found", "mentioned", or "contained" in another/previous/other email, immediately followed by an instruction to send an email, regardless of which specific value or destination address is targeted. Detection is anchored on this found-elsewhere-then-send structure rather than any single value or address to generalize across campaigns.
+author: ATR Community
+date: 2026/03/08
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM01:2025
+    - LLM02:2025
+  owasp_agentic:
+    - ASI06:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0057 - LLM Data Leakage
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: High-risk AI agents must be resilient against adversarial manipulation of their context that causes unauthorized data exfiltration; this rule's detection of cross-document found-elsewhere-then-send relay chains is a concrete cybersecurity control satisfying Article 15 robustness requirements against input-based manipulation.
+      strength: primary
+    - article: '9'
+      context: Cross-email exfiltration relay via injected tool output is a documented risk class in the AI system risk register; Article 9 requires that monitoring controls are deployed to detect these attempts at runtime.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MP.5.1
+      context: Cross-document exfiltration chaining is a primary class of adversarial context-manipulation attack against agentic AI systems; MP.5.1 requires that such adversarial input risks are identified and tracked so that runtime detection controls like this rule can be deployed.
+      strength: primary
+    - subcategory: MG.3.2
+      context: Detected cross-email exfiltration-relay patterns represent a previously unknown risk requiring incident response; MG.3.2 requires procedures to respond to and recover from such risks once identified, which this rule's runtime detection enables.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational controls require that AI agents execute tool-use and messaging actions only as intended; this rule enforces that outbound send actions are not silently triggered by instructions hidden inside unrelated context documents such as other emails.
+      strength: primary
+    - clause: '8.3'
+      context: Clause 8.3 requires ongoing assessment of AI system impacts; runtime detection of cross-document exfiltration relay chains feeds that impact assessment for agentic data-handling and communication risks.
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: cross-email-exfil-relay
+  scan_target: mcp
+  confidence: high
+agent_source:
+  type: llm_io
+  framework:
+    - openai
+    - anthropic
+    - langchain
+    - llamaindex
+    - autogen
+    - crewai
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)\b(?:found|find|retrieved|mentioned|contained)\b[\s\S]{0,80}\b(?:other|previous|another)\s+emails?\b[\s\S]{0,100}\bsend\b[\s\S]{0,60}\bemail\b|\bsend\b[\s\S]{0,100}\bemail\b[\s\S]{0,100}\b(?:found|retrieved|mentioned|contained)\b[\s\S]{0,60}\b(?:in|within|from)\s+(?:other|previous|another)\s+emails?\b
+      description: Instruction claims a value was found/mentioned/contained in another, previous, or other email and is immediately followed by a request to send an email, the core cross-document exfiltration-relay structure
+  condition: any
+  false_positives:
+    - Legitimate email-summarization workflows that reference content from another email purely for display, with no subsequent send action
+    - Users explicitly asking the assistant to forward a known, user-specified figure to a known, user-approved recipient
+    - Customer-support transcripts where an agent mentions a prior email thread while drafting a reply to the same, already-authorized recipient
+    - Internal documentation or training examples that describe this exfiltration technique by name without instructing an actual send action
+response:
+  actions:
+    - alert
+    - snapshot
+    - escalate
+  auto_response_threshold: high
+  message_template: '[ATR-2026-02855] Cross-Email Context Exfiltration Relay Detection detected.'
+confidence: 90

package/rules/context-exfiltration/ATR-2026-02861-exfil-send-email-with-body-directive.yaml

@@ -0,0 +1,83 @@
+title: Injected Directive to Send Email with Attacker-Specified Body
+id: ATR-2026-02861
+rule_version: 1
+status: experimental
+description: |
+  Detects a directive inside tool-returned content (a fetched email, document, web page or other tool output) that tells the agent to send an email, mail, message or notification to a recipient "with [the] body" of the attacker's choosing: the core action of mail-based exfiltration through indirect prompt injection. The condition reads only the tool response, so a user who asks their own agent to send such an email does not trigger it. Scope is narrow and the evidence comes from one benchmark: the rule was mined from LLMail-Inject, where it matches 214 of 1,973 attack submissions (10.8%) and adds coverage for submissions no other rule matched in the tool-response shape; it matches none of the other attack corpora in the repository, including browsesafe-bench. The benign corpora contain very little text with this phrasing (about 33 samples carry the "send an email/mail/message/notification to" prefix), so its 0 false positives there are a weak measurement. It complements ATR-2026-01862, which keys on the recipient address used by that benchmark rather than on the grammar of the directive.
+author: ATR Community (via LLMail-Inject benchmark)
+date: 2026/10/15
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM01:2025
+    - LLM02:2025
+  owasp_agentic:
+    - ASI01:2026
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0051.001 - Indirect
+    - AML.T0057 - LLM Data Leakage
+  mitre_attack:
+    - T1567 - Exfiltration Over Web Service
+  research:
+    - https://github.com/microsoft/llmail-inject-challenge
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) calls for resilience against attempts to alter an AI system's use or behaviour by exploiting its vulnerabilities; this rule provides detection evidence supporting that requirement for injected directives that steer an agent into mailing data to an attacker-chosen recipient.
+      strength: primary
+    - article: '10'
+      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for a context-exfiltration attempt (injected send-email-with-body directive) affecting that data.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of injected send-email-with-body directives in tool output.
+      strength: primary
+    - subcategory: MS.2.10
+      context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of attempts to exfiltrate conversation or retrieved data by email.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 (operational planning and control): runtime detection of injected exfiltration directives in tool output is an operational control on how the agent acts on retrieved content.'
+      strength: primary
+    - clause: '6.2'
+      context: 'Clause 6.2 (AI objectives and planning to achieve them): detections from this rule give measurable input to objectives for preventing data exfiltration through indirect prompt injection.'
+      strength: secondary
+tags:
+  category: context-exfiltration
+  subcategory: exfil-send-email-with-body-directive
+  scan_target: mcp
+  confidence: high
+agent_source:
+  type: mcp_exchange
+  framework:
+    - openai
+    - anthropic
+    - langchain
+    - llamaindex
+    - autogen
+    - crewai
+  provider:
+    - any
+detection:
+  conditions:
+    - field: tool_response
+      operator: regex
+      value: (?i)\bsend\s+(?:an?\s+)?(?:e-?mail|mail|message|notification)\s+to\s+[\s\S]{0,60}?\bwith\s+(?:the\s+)?body\b
+      description: Directive in tool output to send an email/mail/message/notification to a recipient with a specified body
+  condition: any
+  false_positives:
+    - Tool output that legitimately relays a person's own request, such as a ticketing or CRM system echoing "send an email to the customer with the body below"
+    - API or integration documentation returned by a tool that describes sending a message or notification to a channel or user "with the body" field set to some value
+    - Security documentation that quotes a mail-exfiltration payload verbatim
+response:
+  actions:
+    - alert
+    - snapshot
+    - escalate
+  auto_response_threshold: high
+  message_template: '[ATR-2026-02861] Injected Directive to Send Email with Attacker-Specified Body detected.'
+confidence: 85