agent-threat-rules 4.0.0 → 4.2.0

package/rules/privilege-escalation/ATR-2026-02627-web-shell-written-to-served-path.yaml

@@ -0,0 +1,119 @@
+title: Web Shell Written Into a Web-Served Directory
+id: ATR-2026-02627
+rule_version: 3
+status: experimental
+description: |
+  Detects an agent file-write or upload whose destination sits under a web-served directory, whose filename carries a server-executed extension, and whose content is a web shell -- a request superglobal or request parameter passed straight into system(), exec(), passthru(), shell_exec(), proc_open() or eval(). All three must hold. The extension set deliberately includes the denylist-evasion variants (.pht, .phtm, .phps, .phar, .jspx, .ashx) and the double-extension form, because those are chosen precisely when .php and .phtml are already blocked.
+  MEASURED GAP. A PHP web shell written to /var/www/html/uploads/report.pht produced no real matches on any of the five event types tested (three noise hits only), and the JSP equivalent written into a Tomcat webapp matched only the generic ATR-2026-00066 and 00040 on tool_call. No rule in the corpus recognises web-shell CONTENT, and none knows that .pht is executable.
+  HOW THE FALSE POSITIVES WERE REMOVED (v2, adversarial review 2026-08-23). Version 1 used three INDEPENDENT whole-content regexes bound by condition: all -- shell body, served path, and a "write action". That third condition was inert. Its literal set reduces to \bupload\b, \bcopy\b, \btee\b and >{1,2}\s{0,3}/, so it was satisfied by the bare English noun that NAMES this vulnerability class (CWE-434 "Unrestricted File Upload"), by the ordinary verb "copy", and by the "> /" produced by an arrow (-> /var/www/...), a markdown quote or an HTML tag closing before a path (<code>/var/www/...). Worse, because the three regexes matched the whole event independently, the verb could come from one sentence and the path from another. Measured: 16 of 18 held-out benign twins fired, including this rule's own description text, a CWE-434 explainer, a CHANGELOG entry, a GHSA advisory, a forensic timeline, an Ansible hardening playbook, and Chinese and Japanese security bulletins. Two real corpus files fired as well.
+  The fix merges the write action and the destination into ONE condition that requires ADJACENCY: a write primitive in invocation form (followed by "(" or by a JSON quote-delimiter, so "file_put_contents with destination ..." in a scanner report does not qualify) or a shell redirection preceded by whitespace (which excludes "?>", "->" and "=>"), within 80 characters of the served destination, with no "<" in the gap so a quoted shell body cannot bridge the two. Result: 1 of 18 benign twins, 0 of 75,040 benign and documentation corpus files, and all 6 true positives retained.
+  Vulnerable legacy source -- exec($_POST['cmd']) sitting in a repository -- is deliberately NOT matched on its own. That is a static-analysis finding about code at rest, not an agent placing a backdoor, and conflating the two would make this rule fire on every audit of an old PHP codebase.
+  V3 -- ADVERSARIAL REVIEW 2026-08-24. v2's adjacency requirement removed the prose arrows and the bare noun "upload", but it left the SHELL REDIRECTION alternative context-free, and that alternative is the one security writing actually contains. 16 of 20 fresh benign twins fired, all of them quoting a real command line rather than describing one: a blog reporting what the attacker ran (an echo of a one-line PHP command shell redirected into a .php file under /var/www/html/uploads/), an IR runbook's own hunting command, a "Detection:" tip naming tee, a training-lab exercise, a GHSA reproduction step, a CHANGELOG announcing the fix, a forensic timeline, a pentest reproduction, an nginx hardening doc telling you to write a CANARY file to prove the mitigation works, Traditional Chinese and Japanese bulletins, a docker-compose comment, and the same blog delivered through an MCP tool result. Two JSON twins fired as well -- a WAF alert record {"event":"upload","path":"/var/www/.../avatar.php"} and an application audit log {"action":"upload",...} -- because v2 accepted ANY JSON key whose value was the word "upload".
+  THE MEASUREMENT TRAP THAT HID THIS. After a first fix the twins went silent on every hand-rolled event shape yet still fired via corpus-shapes. Reason: src/corpus-event.ts shape 3 (preToolJsonBoth) pours a whole document into {"command": <document>}. A branch keyed on "command": therefore imposes NO constraint on a document -- it is the shape the corpus harness gives every benign file. Requiring a "command" wrapper is indistinguishable from requiring nothing, so that branch was removed rather than kept.
+  THE FIX: cond2 now demands one of four AGENT-ACTION framings --
+    (a) a tool-name key (tool/tool_name/name/function) whose value is a write
+        primitive, followed by a quoted served path with a server-parsed suffix;
+    (b) a heredoc write (cat/echo/printf/tee ... > served-path <<);
+    (c) a code-level write call whose FIRST argument is the served path and
+        whose SECOND argument is an inline <?php / <% body.
+  Prose that quotes a redirection, and JSON whose "upload" is a log field rather than a tool name, no longer match. Measured after the fix: 0 of 20 benign twins, 6 of 6 true positives retained, 26 of 26 pre-existing true negatives retained, plus 8 of 10 fresh round-2 twins clean (legitimate .php page write to the web root, image upload, JSP page write, real .htaccess heredoc, file_put_contents of a real template, put_object, read_file, bash rsync deploy).
+  RESIDUAL, MEASURED: a document that quotes the tool-call JSON verbatim, or a hardening blog that embeds a complete canary heredoc, still fires. Both are signature-quoting, which no single-event rule can separate from the signature.
+  CORPUS CAVEAT: FP-clean on the 13,601-sample benign corpus is a ZERO-MEASUREMENT pass -- only 2 corpus samples contain a served path with a server-parsed extension at all. The twins below are the real evidence.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  cve:
+    - CVE-2026-53593
+    - CVE-2008-2742
+  owasp_llm:
+    - LLM05:2025
+  owasp_agentic:
+    - ASI04:2026
+    - ASI06:2026
+  mitre_atlas:
+    - AML.T0011 - User Execution
+    - AML.T0053 - LLM Plugin Compromise
+compliance:
+  owasp_agentic:
+    - id: ASI04:2026
+      context: Writing a web shell converts the agent's file-write capability into remote code execution on the hosting server.
+      strength: primary
+    - id: ASI06:2026
+      context: The shell persists on disk and grants the attacker a re-entry point long after the agent session ends.
+      strength: secondary
+  owasp_llm:
+    - id: LLM05:2025
+      context: Model-produced content is written to a location where it is executed rather than served as data, which is the improper-handling failure this category names.
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: 'Article 15 robustness: the extension choice is an explicit attempt to defeat the deployment''s own upload controls.'
+      strength: primary
+    - article: '9'
+      context: Backdoor placement by an agent with write access is a documented risk class; these detections are the Article 9 monitoring control.
+      strength: secondary
+    - article: '12'
+      context: 'Article 12 record-keeping: a persisted backdoor must be reconstructable from logs after the fact.'
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for an agent establishing persistent remote access on infrastructure it can write to.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Catalogues web-shell placement, and executable-extension evasion, as risks distinct from generic path traversal.
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events supply the security and resilience evidence MEASURE 2.7 asks be documented for the file-write path.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 operational control: content written into a served directory becomes executable infrastructure outside any change-control path.'
+      strength: primary
+    - clause: '6.2'
+      context: Preventing agent-placed backdoors is an AIMS information security objective under clause 6.2.
+      strength: secondary
+    - clause: '8.4'
+      context: Impact assessment under clause 8.4 must account for an agent whose write access reaches a public web root.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: web-shell-placement
+  scan_target: both
+  confidence: high
+  suppress_in_code_blocks: true
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)(?:\bsystem|\bexec|shell_exec|passthru|popen|proc_open|\beval|\bassert|Process\s*\.\s*Start|Server\s*\.\s*CreateObject|WScript\s*\.\s*Shell|Runtime\s*\.\s*getRuntime\(\)\s*\.\s*exec)\s*\(\s*(?:\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b|request\s*\.\s*getParameter|Request\s*[\[\.(])
+      description: 'Web-shell body: a request superglobal or request parameter passed straight into a command-execution or eval primitive (PHP, JSP or ASP.NET)'
+    - field: content
+      operator: regex
+      value: (?i)(?:["']?(?:tool|tool_name|toolname|name|function)["']?\s{0,3}:\s{0,3}\\?["'](?:write_file|create_file|edit_file|fs_write|writeFileSync|file_put_contents|move_uploaded_file|put_object|apply_patch|str_replace_editor|upload|write)\\?["'][\s\S]{0,300}?["'(]\s{0,3}[^\s"'()<>]{0,80}?(?:/var/www/|/usr/share/nginx/html/|/srv/http/|htdocs/|webapps/|wwwroot/|public_html/|/public/uploads?/|/static/uploads?/|/uploads?/)[^\s"']{0,60}\.(?:php\d?|pht|phtm|phtml|phps|phar|jsp|jspx|jspa|asp|aspx|ashx|cshtml)\b|(?:\b(?:cat|echo|printf|base64|dd)\b[^\n]{0,60}?[ \t]>{1,2}[ \t]{0,3}|\btee\b(?:[ \t]{1,3}-a)?[ \t]{1,3})(?:/var/www/|/usr/share/nginx/html/|/srv/http/|htdocs/|webapps/|wwwroot/|public_html/|/public/uploads?/|/static/uploads?/|/uploads?/)[^\s"']{0,60}\.(?:php\d?|pht|phtm|phtml|phps|phar|jsp|jspx|jspa|asp|aspx|ashx|cshtml)\b[^\n]{0,10}<<|\b(?:file_put_contents|writeFileSync|write_file|fwrite|fputs)\s{0,3}\(\s{0,3}["'][^\s"'()<>]{0,80}?(?:/var/www/|/usr/share/nginx/html/|/srv/http/|htdocs/|webapps/|wwwroot/|public_html/|/public/uploads?/|/static/uploads?/|/uploads?/)[^\s"']{0,60}\.(?:php\d?|pht|phtm|phtml|phps|phar|jsp|jspx|jspa|asp|aspx|ashx|cshtml)\b["']\s{0,3},\s{0,3}["']\s{0,3}<[?%])
+      description: 'A write primitive in INVOCATION form (an open paren, or a JSON quote-delimiter) whose destination appears as a VALUE -- introduced by a quote or paren and continuing as one contiguous token with no spaces -- that carries a web-served path with a server-executed extension; or a shell redirection/tee writing directly to such a path. Requiring the destination to sit in value position is what separates an agent planting a shell from a document describing one: in prose the path is preceded by a space, never by an opening quote.'
+  condition: all
+  false_positives:
+    - 'A scanner or linter TEST FIXTURE that stores the attack verbatim, e.g. a file_put_contents call that writes a one-line PHP command shell to /var/www/html/uploads/a.php, in a SAST repository''s positive-case file. This is the one benign twin of eighteen that still fires, and it is irreducible: the fixture is byte-for-byte the shape of true positive 4, so no single-event rule can separate them. Suppress by path for known fixture directories.'
+    - A rule file in a detection corpus (including this one) that carries the payload in its own test_cases. Two such files exist in this repository; both are rule YAML, not prose documentation.
+    - A penetration test or red-team exercise legitimately deploying a web shell against the operator's own estate. The rule fires by design.
+    - 'NOT a false positive any more: security writing, CWE-434 explainers, IR runbooks, advisories, changelogs, commit messages and hardening playbooks that merely describe the attack. Version 1 fired on all of these because its write-action condition matched the word "upload"; the v2 adjacency requirement removes them. Verified on 18 hand-written benign twins across all 7 event types and 75,040 corpus files.'
+response:
+  actions:
+    - alert
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02627] The agent is writing a web shell into a web-served directory. The extension may have been chosen to evade an upload denylist (.pht/.phtm/.phps/.phar or a double extension). Treat the destination host as compromised until this file is removed.
+confidence: 75

package/rules/privilege-escalation/ATR-2026-02642-agent-config-tool-disables-own-guardrail.yaml

@@ -0,0 +1,115 @@
+title: Agent Configuration Tool Used to Disable the Agent's Own Guardrail
+id: ATR-2026-02642
+rule_version: 2
+status: experimental
+description: |
+  Detects a call to an agent's CONFIGURATION-MUTATION tool -- `config.patch`, `config.apply`, `settings.update`, `set_config` and siblings -- whose payload turns off a protection the agent is subject to: the sandbox, the tool deny-list, the approval requirement, the permission mode, or gateway authentication. CVE-2026-45001 (OpenClaw agent-facing gateway) is the reference case: the same channel the agent uses to adjust harmless preferences also reaches the guard settings, so one tool call converts a constrained agent into an unconstrained one, and every later action looks legitimate because the policy really does permit it.
+  RELATIONSHIP TO ATR-2026-02400 AND ATR-2026-00118. 02400 detects the approval gate being removed by CLI flag or by the `defaultMode` / `autoApprovalSettings` family; 00118 detects approval fatigue. Measured on this repo's engine, neither fires on `{"tool":"config.apply","arguments": {"sandbox":{"enabled":false},"tools":{"denyList":[]}}}`. What this rule adds is the CONFIG-WRITE CHANNEL: the tool name and the disabling assignment together.
+  WHY THE TOOL NAME IS REQUIRED. `denyList: []` on its own is the default value shipped in ordinary config templates, and `sandbox.enabled: false` is a line a developer writes about their own machine. Neither is an attack. The attack is the agent reaching the guard document through its own tool surface, so the pattern requires a config-mutation tool.
+  ADVERSARIAL REVIEW 2026-08-24 -- WHAT "REQUIRES A TOOL NAME" HAD TO BECOME. Twenty-seven benign samples were run through the shipped engine. Against rule_version 1, ELEVEN of the first fifteen fired. Version 1 accepted a METHOD-NAME shape anywhere in the text, and a bare `config.update` / `settings.update` / `policy.apply` is not a tool call -- it is the most common method name in software. It fired on: a pytest fixture doing `config.update({"sandbox": False, "workdir": ...})` (plain dict.update); an ESLint-style `config.merge({... blockList: [] })`; a Kubernetes provisioning manifest with `policy.apply:` and an intentionally empty `denyList: []`; a docker-compose dev override carrying `--config.set` and `auth: "none"`; a VS Code extension calling `.update('telemetry', false)`; a hardening changelog; an incident-response runbook; a Traditional Chinese settings doc; and -- the diagnostic one -- this rule's own prose description of what it detects. The tool name must therefore appear in TOOL-CALL POSITION: as the value of a `"tool"` / `"name"` / `"method"` / `"function"` / `"tool_name"` key. That is the MCP wire shape the rule claims to be about, and it is what version 1's third alternative already did; the two loose alternatives were removed. Two further findings from a second round aimed at the fix: (a) `{"name":"settings.update.sandbox","value":"...sandbox: false..."}` -- an i18n string table whose keys mirror settings paths -- fired, so the tool name may no longer carry a further dotted segment after the config token; (b) a changelog reading `the payload {"tool":"config.apply","arguments": {"theme":"dark"}} now requires an operator token when it carries sandbox: false` fired, because the 200-character bridge joined a benign JSON example to unrelated prose. The disabling assignment's KEY must now be quoted, which is true on the JSON wire and false in prose. Cost: a YAML-bodied config write (`sandbox: false` unquoted) is no longer matched. Stated limit.
+  KNOWN AND ACCEPTED. Documentation or a test harness that contains the COMPLETE tool call, disabling arguments included, still fires; a content rule cannot tell a quoted payload from the payload. Everything that merely DESCRIBES the endpoint or shows a benign example of it is now silent, and that was measured. The rule is alert-only.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  cve:
+    - CVE-2026-45001
+  cwe:
+    - CWE-732
+    - CWE-693
+    - CWE-1188
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI03:2026
+    - ASI06:2026
+  mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
+  mitre_attack:
+    - 'T1562.001 - Impair Defenses: Disable or Modify Tools'
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-45001
+compliance:
+  owasp_agentic:
+    - id: ASI03:2026
+      context: The agent escalates its own privilege by rewriting the document that defines its privilege, using a tool that was scoped for preferences.
+      strength: primary
+    - id: ASI06:2026
+      context: Where the disabled control is the approval requirement, the human-in-the-loop gate is removed by the agent itself rather than by an operator.
+      strength: secondary
+  owasp_llm:
+    - id: LLM06:2025
+      context: 'Excessive agency in its most literal form: the agent widens the boundary it was given instead of operating inside it.'
+      strength: primary
+  eu_ai_act:
+    - article: '14'
+      context: Article 14 human oversight is defeated when the system can switch off the approval requirement that implements it; this rule detects that write.
+      strength: primary
+    - article: '15'
+      context: Article 15 requires resilience of high-risk systems against manipulation; a config channel that reaches the sandbox switch is the manipulation surface, and detections evidence its use.
+      strength: primary
+    - article: '12'
+      context: Guardrail changes must be traceable under Article 12; alerting on each disabling write is the record that makes the change visible after the fact.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Govern
+      subcategory: GV.4.1
+      context: Detects circumvention of the documented technical controls the governance function relies on to bound agent behaviour.
+      strength: primary
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for the risk that an agent disables its own containment before acting.
+      strength: primary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events document whether sandboxing and deny-listing were actually in force, rather than merely configured once.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational control depends on the guard configuration remaining as approved; this rule detects it being changed from inside the system.
+      strength: primary
+    - clause: '9.1'
+      context: Monitoring under clause 9.1 must cover the controls themselves, not only the behaviour they bound.
+      strength: secondary
+    - clause: '6.2'
+      context: Keeping containment settings intact is an AIMS objective under clause 6.2; a disabling write is the measurable failure of that objective.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: guardrail-config-write
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?:["'](?:tool|tool_name|toolname|name|method|function)["']\s{0,3}:\s{0,3}["'][\w./-]{0,20}(?:(?:update|set|patch|apply|write|save|replace|edit|merge)[\w./-]{0,8}(?:config|configuration|settings|policy)|(?:config|configuration|settings|policy)[\w./-]{0,8}(?:update|set|patch|apply|write|save|replace|edit|merge))[\w-]{0,12}["'])[\s\S]{0,200}(?:["']sandbox(?:ed|ing)?["']\s*:\s*(?:false|["'](?:off|none|disabled)["'])|["']sandbox["']\s*:\s*\{[^{}]{0,60}["']enabled["']\s*:\s*false|["'](?:denylist|deny_list|blocklist|block_list|blockedtools|blocked_tools|deniedtools|denied_tools|disallowedtools|disallowed_tools)["']\s*:\s*\[\s*\]|["'](?:requireapproval|require_approval|requireconfirmation|require_confirmation|approvalrequired|approval_required)["']\s*:\s*false|["']permission_?mode["']\s*:\s*["']?bypass|["']auth(?:entication)?["']\s*:\s*["']none["']|["']allowed_?tools["']\s*:\s*\[\s*["']\*["'])
+      description: Config-mutation tool call carrying a guardrail-disabling assignment
+    - field: content
+      operator: regex
+      value: (?:["']sandbox(?:ed|ing)?["']\s*:\s*(?:false|["'](?:off|none|disabled)["'])|["']sandbox["']\s*:\s*\{[^{}]{0,60}["']enabled["']\s*:\s*false|["'](?:denylist|deny_list|blocklist|block_list|blockedtools|blocked_tools|deniedtools|denied_tools|disallowedtools|disallowed_tools)["']\s*:\s*\[\s*\]|["'](?:requireapproval|require_approval|requireconfirmation|require_confirmation|approvalrequired|approval_required)["']\s*:\s*false|["']permission_?mode["']\s*:\s*["']?bypass|["']auth(?:entication)?["']\s*:\s*["']none["'])[\s\S]{0,200}(?:["'](?:tool|tool_name|toolname|name|method|function)["']\s{0,3}:\s{0,3}["'][\w./-]{0,20}(?:(?:update|set|patch|apply|write|save|replace|edit|merge)[\w./-]{0,8}(?:config|configuration|settings|policy)|(?:config|configuration|settings|policy)[\w./-]{0,8}(?:update|set|patch|apply|write|save|replace|edit|merge))[\w-]{0,12}["'])
+      description: Guardrail-disabling assignment followed by the config-mutation tool that carries it
+  condition: any
+  false_positives:
+    - 'Documentation or a changelog that shows the COMPLETE disabling tool call, arguments included (measured: still fires by design). Prose about the endpoint, a tool catalogue, an MCP tools/list manifest, an OpenAPI schema whose default is false, and a benign JSON example next to unrelated prose are all silent as of rule_version 2 -- each was measured.'
+    - A test harness that disables the sandbox on purpose to assert the agent refuses. Only fires if the assertion carries the full tool-call shape; `expect(config.apply({sandbox:{enabled:false}})).rejects` does not, and was measured silent.
+    - An operator legitimately relaxing a policy through the same tool the agent uses -- the shape is identical, so triage by who issued the call
+    - Any ordinary use of a method named config.update / settings.update / policy.apply, including dict.update in Python, config merges in JS tooling, and Kubernetes or Terraform manifests. Eleven benign samples in this class fired rule_version 1; none fires version 2, because the name must sit in tool-call position.
+    - Provisioning code that writes a config file whose deny-list is intentionally empty because allow-listing is used instead
+    - 'A config write whose body is YAML rather than JSON (`sandbox: false` with an unquoted key) is NOT detected. Stated recall limit, taken deliberately in exchange for not firing on prose.'
+response:
+  actions:
+    - alert
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02642] A configuration-mutation tool call disables an agent guardrail (sandbox / tool deny-list / approval requirement / permission mode / gateway auth). Reference: CVE-2026-45001. Treat every subsequent action in this session as unconstrained until the configuration is restored and the origin of this call is established.
+confidence: 75

package/rules/privilege-escalation/ATR-2026-02644-image-magic-polyglot-upload.yaml

@@ -0,0 +1,117 @@
+title: 'Image-Header Polyglot: Magic Bytes Adjacent to a Server-Side Script Payload'
+id: ATR-2026-02644
+rule_version: 1
+status: experimental
+description: |
+  Detects content that opens with an IMAGE (or PDF) magic header, follows it IMMEDIATELY with a server-side script opener -- `GIF89a<?php`, `%PDF-1.4 <?php`, `GIF87a<script`, `GIF89a<%` -- and then carries an actual execution primitive. This is the shape of an upload built to pass a content-type or magic-byte check and still execute once it lands. CVE-2025-55743 (UnoPim) is the reference case: client-side-only validation, so the file that reaches disk is a valid-looking image whose body is PHP.
+  THREE PARTS, EACH FORCED BY A MEASUREMENT (2026-08-24 adversarial review, 24 benign probes run through the shipped engine).
+    1. ADJACENCY. The bridge between header and opener admits only
+       NON-ALPHABETIC filler -- space, tab, semicolon, control and high bytes,
+       never a newline and never a letter. The published version instead
+       forbade quotes/commas/newlines and capped the bridge at 16 characters,
+       on the theory that a real polyglot is one byte string. Ordinary prose
+       fits in 16 characters without a quote or a comma, so it fired on a
+       library changelog, a QA runbook, a forensic tool's output, a markdown
+       magic-number table and its Traditional Chinese equivalent.
+    2. PAYLOAD. An execution primitive must appear within 60 characters of the
+       opener. Without it, a tab-separated signature table, a space-aligned
+       reference table and a WAF denylist (`GIF89a;<?php;<%@;<script`) still
+       fired -- all of them documentation and configuration that DEFENDS
+       against this attack.
+    3. The double-extension condition was REMOVED, not repaired. See below.
+
+  WHY THE DOUBLE-EXTENSION CONDITION IS GONE. It matched `<word>.<exec-ext>.<image-ext>` and could not be separated from ordinary derived-artifact naming, because the two are the same string. `screenshots/checkout.aspx.png` (a Playwright artifact named after the page under test), `docs/img/dashboard.jsp.png`, `wireframes/cart.asp.svg`, `report.cgi.csv` and `print/invoice.phtml.pdf` all fired, and the rule's own true positive for that condition was `saved report.aspx.png to the public assets directory` -- indistinguishable. Naming a screenshot, export or rendered PDF after its source page is standard practice, and `pl` (the Polish ISO-639-1 code) collided with the whole localized-documentation family: `user-guide.pl.pdf`, `dashboard.pl.png`, `LICENSE.pl.txt`, `strings.pl.csv`, `architecture.pl.svg`, `umowa.pl.docx`. Double extensions are therefore a STATED GAP for this rule; detecting them needs upload-path context (the parameter the filename arrives in and the directory it lands in), not a filename pattern.
+  RESIDUAL. Text quoting a COMPLETE polyglot verbatim -- header, opener and execution primitive together, as an advisory or this rule's own test cases -- IS the payload and fires. That is inherent to a byte-level signature and is reported, not engineered away. Partial quotations no longer fire, which is what keeps the residual narrow.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2025-55743
+    - CVE-2008-2742
+  cwe:
+    - CWE-434
+    - CWE-646
+  owasp_llm:
+    - LLM05:2025
+  owasp_agentic:
+    - ASI03:2026
+  mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
+  mitre_attack:
+    - 'T1505.003 - Server Software Component: Web Shell'
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-55743
+compliance:
+  owasp_agentic:
+    - id: ASI03:2026
+      context: An agent that writes or forwards this content plants an execution primitive on the target host, converting file-write authority into code-execution authority.
+      strength: primary
+  owasp_llm:
+    - id: LLM05:2025
+      context: 'Improper output handling: content the agent produces or relays is treated as an image by validation and as code by the server that stores it.'
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: 'Article 15 accuracy and robustness: a system that passes attacker content through a validation layer it defeats is not robust, and detections here evidence attempts on that path.'
+      strength: primary
+    - article: '9'
+      context: File upload through an agent is a documented risk source; these detections are the Article 9 monitoring control for it.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for the risk that agent-mediated file writes carry executable payloads disguised as media.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: Characterises content-type spoofing as a distinct risk from prompt injection in the agent's write path.
+      strength: secondary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events document the security of the upload path that MEASURE 2.7 asks to be evidenced.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational control over what the system writes to externally provided storage.
+      strength: primary
+    - clause: '8.4'
+      context: Impact assessment under clause 8.4 must account for artifacts the system stores being executed by the host that stores them.
+      strength: secondary
+    - clause: '6.2'
+      context: Preventing the system from becoming a delivery vehicle for executable content is an AIMS objective under clause 6.2.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: content-type-polyglot
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?:GIF8[79]a|%PDF-1\.[0-9]|\x89PNG|\\x89PNG|\xff\xd8\xff|\\xff\\xd8\\xff)(?:[; \t\x00-\x08\x0b\x0c\x80-\xff]{0,6}(?:<\?php|<\?=|<%@|<script|<jsp:|#!\s{0,2}/(?:bin|usr))|<%[ \t=])[^\r\n]{0,60}(?:system|passthru|shell_exec|proc_open|popen|\bexec\b|\beval\b|assert|base64_decode|file_put_contents|move_uploaded_file|fetch\s{0,2}\(|document\.cookie|getRuntime|\$_(?:GET|POST|REQUEST|COOKIE|SERVER|FILES))
+      description: Image or PDF magic header, a server-side script opener adjacent to it, and an execution primitive in the body
+  condition: any
+  false_positives:
+    - 'Security research or advisory text reproducing a COMPLETE CVE-2025-55743 payload -- header, opener AND execution primitive together. This is the one residual and it is inherent to a byte-level signature: the quoted payload is byte-identical to the payload. Partial quotations no longer fire, which is what makes the residual narrow.'
+    - 'MEASURED AND FIXED 2026-08-24 (adversarial review, 24 benign probes). The published version fired on 15 of 16 first-wave probes. The author''s premise -- that a bridge forbidding quotes, commas and newlines and capped at 16 characters implies one byte string -- was false: ordinary prose fits inside it. These all fired and are now clean: ''added GIF89a and <script sniffing to the content-type detector'' (library changelog); ''The PNG signature \x89PNG and the <?php opener are both short byte strings''; ''upload %PDF-1.4 with <script> annotations and confirm the viewer strips JavaScript'' (QA runbook); ''File.write(dest, "%PDF-1.4 <%= body %>")'' (ERB template emitting a PDF header); ''signatures found: GIF89a at 0x0; #!/bin/sh at 0x40'' (forensic tool output); ''| GIF89a | image/gif | <?php | text/x-php |'' (markdown reference table -- pipes are neither quotes nor commas); and the same table in Traditional Chinese. Fixed by forbidding LETTERS in the bridge rather than counting characters.'
+    - 'MEASURED AND FIXED 2026-08-24, second wave. With prose excluded, three signature-reference forms still fired because their separators are punctuation: a tab-separated magic-number table, a space-aligned two-column table, and ''deny_signatures = GIF89a;<?php;<%@;<script'' (a WAF denylist -- byte-identical to the classic polyglot). Fixed by requiring an execution primitive (system/passthru/shell_exec/exec/eval/$_GET/document.cookie/getRuntime/...) within 60 characters of the opener. A reference table names openers; a polyglot carries a payload.'
+    - 'STATED GAP: a polyglot whose payload uses none of the listed execution primitives (a pure data-staging web shell, or an obfuscated dispatcher) is not detected. That is the price of the second-wave fix and is preferred to firing on every WAF denylist.'
+    - 'STATED GAP: raw binary GIF header bytes above \x7f are allowed in the bridge, but a genuine binary upload arriving base64-encoded is not decoded here and is not detected.'
+response:
+  actions:
+    - alert
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02644] Content whose image/PDF magic header is immediately followed by a server-side script opener AND an execution primitive. This is an upload built to pass content-type validation and execute after storage. Reference: CVE-2025-55743. Do not write this file to a served directory.
+confidence: 70

package/rules/privilege-escalation/ATR-2026-02648-readonly-graph-tool-write-procedure.yaml

@@ -0,0 +1,107 @@
+title: Write or Fetch Procedure Called Through a Read-Only Graph Query Tool
+id: ATR-2026-02648
+rule_version: 2
+status: experimental
+description: |
+  Detects a query, carried in the argument of a tool that declares itself READ-ONLY, that calls a procedure the read-only mode was supposed to exclude: `CALL apoc.cypher.doIt`, `apoc.cypher.runFile`, `apoc.periodic.submit`, `apoc.trigger.add`, `apoc.load.json`, `apoc.export.*`, `dbms.security.*`, or a Cypher write clause such as `DETACH DELETE` / `CREATE USER` / `GRANT ROLE`. CVE-2026-35402 (mcp-neo4j-cypher) is the reference case: read-only was enforced by inspecting the query's top-level clause, and `CALL` is not a write clause, so every APOC procedure behind it ran with full authority. The KQL sibling `| externaldata(...)` is included because it is the same move in a different query language -- a read verb that reaches outside the database.
+  WHY ATR IS BLIND HERE TODAY. Measured on this repo's engine, the SQL equivalents of these payloads are caught (ATR-2026-01601, ATR-2026-00066) and the Cypher/KQL forms produce nothing but the tool-name noise rule ATR-2026-00099. ATR knows SQL and does not know the other query languages.
+  WHY VERSION 1 WAS WITHDRAWN. It required only that the TOKEN `read-only`, `readonly`, `read_query` or `neo4j_read` appear within 240 characters of a procedure call. Adversarial review fired it on 13 of 16 benign probes, none of which involved an agent at all: the APOC manual sentence "the first statement must be read-only" beside `CALL apoc.periodic.iterate(...)`; a TypeScript `readonly database: string` beside a purge query (the `readonly` modifier is in every typed codebase); the Cypher manual page for DETACH DELETE; the Azure KQL page for `externaldata`; an onboarding runbook granting a read-only reporting role; a CI teardown log; a docker-compose file; a CHANGELOG; a Traditional-Chinese operations note; the CVE-2026-35402 advisory itself; and the hardening checklist that enumerates the very procedures the tool must reject -- which the author believed had been excluded by requiring a following `(`, but a checklist writes the parentheses too.
+  WHAT VERSION 2 REQUIRES INSTEAD. The event must BE a call to a read-scoped tool: a tool-invocation object whose tool name is read-scoped, or one carrying `read_only: true`. Prose that discusses such a tool no longer qualifies. A second round of probes -- benign traffic through a genuinely read-scoped tool -- forced three more constraints: the procedure must sit inside an ARGUMENT (a result set carrying stored migration scripts is not a query); it must sit at a statement boundary or at the head of a quoted argument value (`CONTAINS 'DETACH DELETE n'` is a search FOR the clause); and `apoc.create.*` / `apoc.export.*` are narrowed so that virtual-node helpers and the streaming schema dump `apoc.export.cypher.schema(null, {stream:true})`, which writes nothing, do not count.
+  ATR-2026-02100 already covers `apoc.load.json('file:///...')` -- the local file-scheme case. This rule does not restate it; what it adds is the read-only-mode bypass, whatever the procedure's argument happens to be.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-35402
+  cwe:
+    - CWE-863
+    - CWE-89
+    - CWE-693
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI03:2026
+  mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-35402
+compliance:
+  owasp_agentic:
+    - id: ASI03:2026
+      context: The agent obtains write and outbound-fetch authority through a tool that was granted read authority only; the boundary is crossed inside the query language.
+      strength: primary
+  owasp_llm:
+    - id: LLM06:2025
+      context: 'Excessive agency: the effective permission of a tool is wider than the permission its declaration and its name assert.'
+      strength: primary
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 requires high-risk systems to be resilient against attempts to exceed their intended operation; a read-only gate defeated inside the query text is exactly such an attempt.
+      strength: primary
+    - article: '9'
+      context: Tool-permission drift is a documented risk for agent deployments; these detections are the Article 9 monitoring control for it.
+      strength: secondary
+    - article: '12'
+      context: Article 12 traceability -- a write that arrived through a read tool leaves no other record that the mode was bypassed.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Govern
+      subcategory: GV.4.1
+      context: Detects circumvention of the least-privilege control that scopes a database tool to reads.
+      strength: primary
+    - function: Manage
+      subcategory: MG.2.3
+      context: Runtime treatment for the risk that query-language features exceed the declared tool permission.
+      strength: primary
+    - function: Measure
+      subcategory: MS.2.7
+      context: Detection events evidence whether read-only enforcement actually held, rather than being assumed from configuration.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'Clause 8.1 operational control: a read-scoped integration that can write or fetch is outside the operating envelope that was approved.'
+      strength: primary
+    - clause: '9.1'
+      context: Monitoring under clause 9.1 must cover whether declared tool permissions are the effective ones.
+      strength: secondary
+    - clause: '6.2'
+      context: Keeping data-store access least-privileged is an AIMS objective under clause 6.2; this rule is its runtime control for graph and log query languages.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: query-language-readonly-bypass
+  scan_target: both
+  confidence: medium
+  suppress_in_code_blocks: true
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: ^\s{0,8}\{[^{}]{0,160}(?:["'](?:tool|tool_name|toolName|name|function|mcp_tool)["']\s*:\s*["'][\w.\-]{0,30}(?:read[_.\-]?(?:only|neo4j|cypher|graph|query|kql|kusto)|(?:neo4j|cypher|graph|kusto|kql)[\w.\-]{0,8}read)[\w.\-]{0,20}["']|["']?read_?only["']?\s*:\s*(?:true|["'](?:on|yes|1)["']))
+      description: The event is an invocation of a read-scoped query tool, or carries an explicit read_only flag
+    - field: content
+      operator: regex
+      value: '["''](?:arguments|args|input|params|query|cypher|statement|stmt|kql|sql|q|command|script|text)["''][\s\S]{0,240}(?:^|[\s;,{(]|:\s{0,4}[\\]{0,2}["''\x60]\s{0,4})(?:CALL\s+apoc\.(?:cypher\.(?:doIt|runFile|runSchemaFile|runMany|runWrite)|periodic\.(?:submit|repeat|iterate|commit)|trigger\.(?:add|install)|refactor\.[\w]{1,24}|create\.(?:node|nodes|relationship|relationships|addLabels|removeLabels|setProperty|setProperties|setLabels|setRelProperty|uuids)|merge\.[\w]{1,24}|load\.(?:json|csv|xml|jdbc)(?:Params)?|systemdb\.[\w.]{1,24})\s*\(|CALL\s+apoc\.export\.[\w.]{1,24}\s*\(\s*[\\]{0,2}["''\x60]|DETACH\s+DELETE\s+[\w$(]|CREATE\s+(?:USER|ROLE)\s+[\w$]|DROP\s+(?:USER|ROLE)\s+[\w$]|dbms\.security\.[\w]{1,32}\s*\(|GRANT\s+(?:ROLE|ALL|WRITE|ADMIN)\s+[\w$]|\|\s*externaldata\s*\()'
+      description: A write, administrative or outbound-fetch procedure is actually invoked inside a call argument
+  condition: all
+  false_positives:
+    - 'A read-scoped tool asked to EXPLAIN or PROFILE a write statement. `{"tool":"read_neo4j_cypher","arguments":{"query":"EXPLAIN MATCH (n:Stale) DETACH DELETE n"}}` plans the write without running it. Measured residual: 1 of 28 benign probes. Excluding it needs a negative lookbehind, which RE2 does not have and the array condition format cannot express; a read-only tool being asked to plan a destructive statement is worth the alert'
+    - A migration or admin job whose tool is genuinely named read_* and legitimately writes
+    - Advisory text for CVE-2026-35402 quoting the payload, if it is written as a tool-invocation object rather than as prose
+response:
+  actions:
+    - alert
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02648] A query issued through a read-only graph/log tool calls a write, administrative or outbound-fetch procedure (apoc.cypher.doIt, apoc.periodic.*, apoc.trigger.*, apoc.load.*, dbms.security.*, DETACH DELETE, CREATE USER, KQL externaldata). Reference: CVE-2026-35402. The tool''s read-only promise did not hold; verify what the query changed.
+confidence: 70

package/rules/privilege-escalation/ATR-2026-02664-git-identifier-field-option-injection.yaml

@@ -0,0 +1,100 @@
+title: 'Git Identifier Field Carries an Option or ext:: Transport Instead of a Revision'
+id: ATR-2026-02664
+rule_version: 2
+status: experimental
+description: |
+  Detects a value that is supposed to be a git revision -- a 40-hex commit, a tag, a branch -- but is written as a git OPTION, so git parses it as one. The three executing forms are all here: a commit/ref field whose value starts with a dash, --upload-pack= / --receive-pack= pointed at a shell or a script instead of the git-*-pack binary, and the ext:: transport handing a command to /bin/sh. Mined from CVE-2026-50014 (pnpm): resolution.commit from a lockfile was interpolated into the git fetch argument list with no -- separator and no format check, so a poisoned lockfile executed code during install. The shape generalises past pnpm to any agent that reads a manifest, lockfile or issue body and passes an "identifier" straight to git. NOTE what is NOT flagged: --upload-pack= aimed at a real git-upload-pack binary (the option's legitimate use for servers with a non-standard install path, INCLUDING a .sh wrapper outside /tmp) and ext::ssh (the documented remote-ext helper).
+  RECALL GIVEN UP IN rule_version 2, DELIBERATELY. Condition 1 now names a closed set of executing options (upload-pack, receive-pack, exec, output, config) instead of accepting any dash-word, so an executing option outside that set -- say --separate-git-dir= -- is missed. Condition 2 needs the pack program to be an interpreter or to live under a world-writable directory, so a payload script parked elsewhere is missed. Both were traded for the nine benign inputs rule_version 1 fired on.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-50014
+  cwe:
+    - CWE-88
+    - CWE-78
+  owasp_llm:
+    - LLM05:2025
+  owasp_agentic:
+    - ASI05:2026
+    - ASI04:2026
+  mitre_attack:
+    - T1195.001 - Compromise Software Dependencies and Development Tools
+    - T1059.004 - Unix Shell
+  mitre_atlas:
+    - AML.T0010 - AI Supply Chain Compromise
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-50014
+    - https://git-scm.com/docs/git-remote-ext
+metadata_provenance:
+  cve: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resistance to third parties exploiting vulnerabilities; this rule detects argument injection through a dependency identifier, which turns a package install into arbitrary execution.
+      strength: primary
+    - article: '9'
+      context: 'Article 9 (risk management system): supply-chain argument injection is an identified risk whose runtime treatment is this detection.'
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Dependency-resolution argument injection is an identified AI supply-chain risk; this rule is the active runtime countermeasure.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing lockfile-driven argument injection in the organizational AI risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by checking that identifier-typed fields carry identifiers before they reach a subprocess.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by alerting on the injected option before git executes it.
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: git-argument-injection
+  scan_target: runtime
+  confidence: high
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: \b(?:commit|commitish|revision|treeish|refname|gitref)["']?\s{0,3}[:=]\s{0,3}["']?-{1,2}(?:upload-pack|receive-pack|exec|output|config)[=\s]
+      description: 'A field named for a git revision whose value is one of git''s EXECUTING options -- CVE-2026-50014''s resolution.commit primitive. rule_version 1 accepted any dash-word here, which made every ordinary rev-list option passed through a revision-named parameter a match: {"revision": "--since=2 weeks ago"} from a git MCP server, `revision: --all | --branches | --tags` in a mirror-job config, `commit: --amend` in a runbook. Those are identifiers-that-are-flags but they do not execute.'
+    - field: content
+      operator: regex
+      value: '--(?:upload|receive)-pack\s{0,2}=\s{0,2}["'']?(?:/tmp/|/dev/shm/|/var/tmp/|\bsh\b|\bbash\b|\bcurl\b|\bwget\b|\bpython\d{0,1}\b|\bperl\b|\bnc\b)'
+      description: '--upload-pack= / --receive-pack= pointed at a shell, an interpreter, or anything under a world-writable directory. Under the ssh and local transports git executes this value. rule_version 1 also accepted any path ending .sh/.py/.pl/.rb, which flagged the legitimate server practice of wrapping the pack program in a script to set the environment first (--receive-pack=/opt/gerrit/bin/receive-pack.sh).'
+    - field: content
+      operator: regex
+      value: (?:["']|=\s{0,2})ext::\s{0,2}(?:sh|bash|dash|zsh|curl|wget|python\d{0,1}|perl|nc|env)[\s"']
+      description: 'git''s ext:: transport invoking a shell or interpreter as the transport helper, in URL position: quoted on a command line, or after `url =` in a .gitmodules / .git/config entry. ext::ssh, the documented use, does not match. rule_version 1 matched a bare `ext::` anywhere, so it fired on the NAMESPACE separator in ordinary source (`use crate::ext::env`, `Ext::Curl.get(url)`) and on any sentence explaining the transport.'
+  false_positives:
+    - '--upload-pack=/opt/git/bin/git-upload-pack and --receive-pack=/usr/local/bin/git-receive-pack: the option''s real purpose on servers with a non-standard git install. Excluded because the value must be a shell, an interpreter or a script path.'
+    - ext::ssh %S user@host %p, the remote-ext example straight out of the git documentation. Excluded because ssh is not in the interpreter list.
+    - 'A commit field holding a real sha, tag or branch (commit: 4f2b1c9..., branch: release-1.4), or an ordinary rev-list option in a revision-named parameter (--since=, --all, --amend, --first-parent). Excluded because the value must be one of git''s executing options.'
+    - 'A .sh wrapper around git-upload-pack / git-receive-pack outside a world-writable directory: legitimate server practice, no longer claimed.'
+    - '`ext::` used as a namespace separator in Rust, Ruby or C++ source, and prose explaining what the ext:: transport does. Excluded because the transport must appear in URL position (quoted, or after `url =`).'
+    - 'MEASURED AND NOT FIXED. Security writing that QUOTES the executing payload -- ''the advisory shows commit: --upload-pack=/tmp/x.sh executed during install'' -- contains the payload and still fires. This is the residue of a byte-level signature and is why the action is alert only. Sixteen benign samples were run against rule_version 2; these two prose shapes are the only ones that matched.'
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02664] A git revision/identifier argument is an option or an ext:: transport command, not a revision. git will execute it. Reject the value or pass it after a -- separator.
+confidence: 84