agent-threat-rules 4.0.0 → 4.2.0

package/rules/tool-poisoning/ATR-2026-02682-xml-entity-expansion-bomb.yaml

@@ -0,0 +1,98 @@
+title: XML/SVG Entity Expansion Bomb in Content Returned to an Agent
+id: ATR-2026-02682
+rule_version: 2
+status: experimental
+description: |
+  Detects an entity-expansion bomb (billion laughs / quadratic blowup) inside XML, SVG, SBOM, XLSX-sheet or DTD content that a tool returns to an agent, or that an agent writes out. The decisive text is a DTD entity whose replacement value is a packed run of six or more entity references -- <!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;"> -- which is the only reason to write such a value: each layer multiplies, so a few hundred bytes expand to gigabytes and the parser, not the network, is what fails. Mined from CVE-2026-25128 (fast-xml-parser numeric-entity RangeError DoS). ATR already covers the OTHER half of the DTD attack surface -- external entities pulling file:// or http:// URLs (ATR-2026-00568 / ATR-2026-01608) -- because those rules key on a URI scheme. An expansion bomb contains no URI at all, so nothing in the corpus sees it. Benign DTDs are deliberately excluded: an entity table (<!ENTITY copyright "&#169; 2026 Example Ltd">) and a composite entity built from a handful of separated references (<!ENTITY footer "&company; &address; &phone;">) both fail the pattern, which requires SIX OR MORE references with no separator between them.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: medium
+references:
+  cve:
+    - CVE-2026-25128
+  cwe:
+    - CWE-776
+    - CWE-400
+  owasp_llm:
+    - LLM10:2025
+    - LLM05:2025
+  owasp_agentic:
+    - ASI06:2026
+    - ASI03:2026
+  mitre_attack:
+    - T1499.004 - Application or System Exploitation
+  mitre_atlas:
+    - AML.T0029 - Denial of ML Service
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-25128
+    - https://cwe.mitre.org/data/definitions/776.html
+metadata_provenance:
+  cve: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires AI systems to be resilient against attempts to exploit vulnerabilities; this rule detects a parser resource-exhaustion payload arriving through tool output.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated; availability loss through untrusted-document parsing is treated here at runtime.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Denial of service through untrusted document ingestion is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MS.2.6
+      context: Measuring AI system resilience and safety under adversarial input; this rule instruments the resource-exhaustion case.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by screening ingested documents for expansion bombs before they reach a parser.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by alerting on the bomb's entity-chain signature.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: xml-entity-expansion-bomb
+  scan_target: agent
+  confidence: high
+  suppress_in_code_blocks: true
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)<!entity\s+(?:%\s*)?[\w.-]{1,24}\s+["'][^"']{0,200}["']\s*>[\s\S]{0,200}<!entity\s+(?:%\s*)?[\w.-]{1,24}\s+["'](?:[&%][\w.-]{1,12};){6,}
+      description: 'An entity declaration with a real body, followed within 200 characters by an entity whose value is a packed run of six or more references -- the two-layer structure a billion-laughs bomb needs. The chain is required because a single declaration cannot multiply: it expands once and stops.'
+    - field: content
+      operator: regex
+      value: (?i)<!entity\s+(?:%\s*)?[\w.-]{1,24}\s+["'](?:[&%][\w.-]{1,12};){6,}[\s\S]{0,200}<!entity\s+(?:%\s*)?[\w.-]{1,24}\s+["'](?:[^&"'\r\n]|&[^#"'\r\n])
+      description: The same two layers in the reverse declaration order, with the companion entity required to have a real body rather than a bare character reference (which is what a spacing or punctuation entity points at).
+  false_positives:
+    - 'FIXED in rule_version 2 -- A PACKED RUN OF CHARACTER ENTITIES IS NOT A BOMB. The pattern keyed on the run alone, so it fired on the ordinary publishing idiom of defining a fixed amount of space or punctuation: <!ENTITY sp6 "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;">, an em-dash rule, a table-of-contents leader of &hellip;, an &emsp; gutter, and a DTD content model concatenating six short parameter entities. None of these can multiply -- they reference a character entity, expand exactly once and stop, which is the opposite of the property this rule exists to detect. The rule now requires the TWO-LAYER CHAIN a bomb needs: a companion entity declaration with a real body, either before the packed run or after it. Four measured FPs plus one DTD case are silent; all three true positives are unaffected.'
+    - 'FIXED in rule_version 2 -- the same chain requirement removed the entire quotation class. Security writing quotes the ONE decisive line (<!ENTITY lol2 "&lol;&lol;...">) because that line is the explanation; it does not carry the companion declaration that makes the line dangerous. Measured: an unfenced CVE-2026-25128 write-up, the same write-up in Traditional Chinese, a hardening CHANGELOG and a fuzzer log line all fired before and are silent after. This was previously documented as a KNOWN RESIDUAL that suppress_in_code_blocks could only half-cover; it is now genuinely fixed rather than suppressed.'
+    - 'RESIDUAL, MEASURED AND IRREDUCIBLE: a parser''s own regression fixture -- tests/fixtures/billion_laughs.xml, checked in so the test can assert the parser REFUSES it -- still fires. The file is a complete, working bomb; it is benign only because of where it lives, and no pattern over its bytes can know that.'
+    - 'EVASION, STATED PLAINLY: the chain requirement gives a 200-character proximity window between the two declarations. A bomb that pads the gap wider than that, or that splits its layers across two documents, is no longer detected. Both declaration orders are covered, so simply reordering them does not evade.'
+    - An ordinary entity table such as <!ENTITY copyright "&#169; 2026 Example Ltd"> or <!ENTITY amp "&#38;"> -- a single reference, not a packed run
+    - A composite entity built from separated references, e.g. <!ENTITY footer "&company; &address; &phone;"> -- the spaces break the run and the count is below six
+    - XHTML/DocBook DTD driver files that declare and immediately invoke parameter entities (%HTMLlat1;) -- each declaration holds a public identifier, not a reference run
+    - 'A security article or advisory that prints the billion-laughs payload: the rule sets suppress_in_code_blocks, so a payload inside a markdown fence or inline backticks is not reported. KNOWN RESIDUAL: an article that pastes the payload as bare prose, with no fence and no backticks, will still match -- and so would a poisoned document, which is the reason the suppression is limited to code context rather than removed.'
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02682] Ingested XML/SVG/DTD content declares an entity whose value is a packed run of entity references -- an expansion bomb. Do not hand this document to an XML parser; expansion is multiplicative and will exhaust memory before any content is produced.
+confidence: 82

package/rules/tool-poisoning/ATR-2026-02707-crlf-header-injection-mail-tool-argument.yaml

@@ -0,0 +1,88 @@
+title: Mail or Attachment Tool Argument Splits into a New Header via Embedded CRLF
+id: ATR-2026-02707
+rule_version: 2
+status: experimental
+description: |
+  Detects a recipient, subject or filename argument of an agent mail/attachment tool whose QUOTED value contains a line break followed by a fresh RFC 5322 / MIME header name or an SMTP verb -- `to: "user@corp.example\r\nBcc: watcher@collector.example"`, `filename: "report.pdf\r\nContent-Type: text/html"`, `\r\nRCPT TO:`. Mined from CVE-2026-30227 (MimeKit CRLF injection in a quoted local-part enabling SMTP command injection and sender forgery); the same one-value-becomes-two-lines shape is what CVE-2026-43882 exploits in ICS and what header smuggling exploits in HTTP. Verified on the shipped engine that `{"tool":"send_email","to":"user\r\nBcc: watcher@..."}` matched only ATR-2026-00063/00099, and that a BENIGN control (`to: alice@corp.example, subject: Q3`) matched the same rules -- i.e. those hits are spray, not coverage of CRLF at all. The opening quote is required deliberately: without it the condition fires on every raw RFC822 header block (`From: alice@corp.example` newline `To: ...`), which is ordinary mailbox content and was the first false positive this rule produced during authoring.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cwe:
+    - CWE-93
+    - CWE-77
+  owasp_llm:
+    - LLM05:2025
+  owasp_agentic:
+    - ASI04:2026
+  mitre_attack:
+    - T1114 - Email Collection
+  mitre_atlas:
+    - AML.T0053 - LLM Plugin Compromise
+  cve:
+    - CVE-2026-30227
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-30227
+metadata_provenance:
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resilience against inputs that alter system behaviour; this rule detects a mail-tool argument that splits into an additional header, silently adding a recipient or changing the MIME type.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated; this rule is the runtime treatment for CRLF header injection through agent mail tools.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Silent recipient injection through an agent mail tool is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing CRLF-driven header splitting in tool arguments as an AI-specific risk in the organizational risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by rejecting line breaks in single-line tool arguments before the message is submitted.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented through runtime detection of the header split.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: crlf-header-injection-tool-argument
+  scan_target: runtime
+  confidence: high
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: '["\x27](?:to|cc|bcc|from|reply[_-]?to|subject|filename|attachment)["\x27]\s{0,3}[:=]\s{0,3}["\x27][^"\x27\r\n]{0,40}(?:\\r)?(?:\\n|[\r\n])\s{0,4}(?:bcc|cc|reply-to|content-type|content-transfer-encoding|content-disposition|mime-version|rcpt\s{1,3}to|mail\s{1,3}from|x-[a-z][a-z0-9-]{1,20})\s{0,2}:'
+      description: 'A recipient/subject/filename argument whose QUOTED KEY and QUOTED VALUE come from a serialized tool call, and whose value contains a line break followed by a new mail header name or SMTP verb. rule_version 2 made the KEY quote mandatory as well as the value quote. Version 1 required only the value quote, and that let every piece of writing ABOUT this attack through: an advisory saying to="user@corp.example\r\nBcc: ...", a library changelog, a WAF signature note, an OWASP-style cheat sheet, a pentest finding and a non-English advisory all fired, because documentation writes the argument assignment exactly the way the attack does -- with an unquoted key. Every one of this rule''s own true positives and its evasion test uses the quoted-key form, so recall is unchanged.'
+  false_positives:
+    - 'ADVERSARIAL, 2026-08-24 refutation pass: rule_version 1 fired on 6 of 14 benign probes, ALL of them security writing that quotes the payload with its argument assignment -- the CVE-2026-30227 advisory, a library changelog, a WAF signature note, an OWASP-style explanation, a pentest finding, and a Traditional Chinese advisory. Version 1''s false-positive list claimed documentation normally quotes the payload WITHOUT an argument assignment; that claim was wrong. Fixed by requiring the argument key to be quote-delimited, which prose is not. All six are now true_negatives.'
+    - 'RESIDUAL, accepted: an article or eval dataset that reproduces the verbatim serialized call still matches -- same bytes as the attack.'
+    - 'RESIDUAL, ambiguous by design: a mail parser that joins repeated headers of the same name into one value ({"cc":"a@corp.example\r\nCc: c@corp.example"}) matches. This is NOT excluded on purpose: a value that adds a second Cc recipient is the attack whether a parser or an attacker produced it, and RE2 has no backreference with which to require that the injected header name differ from the argument name.'
+    - 'A raw RFC822 message or mailbox export, where From:/To:/Subject: lines follow one another unquoted. The condition requires an opening quote immediately before the value, which unquoted header blocks do not have -- this was the first measured false positive during authoring and the reason the quote is mandatory.'
+    - A parsed email object ({"from":"alice@corp.example","to":"bob@corp.example"}), because each value is closed before the next field and no line break sits inside a value.
+    - A multi-line message BODY, since body/text/html/content are not in the argument-name set.
+    - Documentation describing CRLF injection, which normally quotes the payload without a preceding argument assignment inside quotes.
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02707] A mail or attachment tool argument contains a line break followed by a new header name -- one value is becoming two headers. Reject CR and LF in single-line address, subject and filename parameters.
+confidence: 80

package/rules/tool-poisoning/ATR-2026-02817-untrusted-content-dictates-tool-arguments.yaml

@@ -0,0 +1,83 @@
+title: Untrusted Tool Result Dictates a Tool Call by Schema Parameter Name
+id: ATR-2026-02817
+rule_version: 1
+status: experimental
+description: |
+  Detects untrusted content inside a tool result that speaks the agent's OWN tool-schema vocabulary: it names the target function and binds each parameter by its literal schema name to a chosen value, then asks the assistant to construct exactly those arguments and issue the call. This is not an imperative wish ("please transfer 500 dollars") — which ATR already covers — it is a serialised call specification planted in a bill description, a review body or a message body, so the model's remaining work is transcription rather than intent formation. Source: AutoDojo variant generation over the AgentDojo banking and slack suites (agentdojo/variant_generation/variants/banking/.../injections.json and banking_rlhammer.json). Measured before authoring: 4 verbatim variants of this shape produced 1 hit across 785 rules, and that hit was ATR-2026-00504 firing incidentally on the words "full ... overview ... tools", not on the call-spec structure. TWO CONJUNCTS, BOTH REQUIRED. (1) An AGENT-DIRECTED request to emit the call. A bare "call the send_money function with the parameter recipient set to ..." is deliberately NOT matched, because that is exactly how API reference documentation, OpenAPI descriptions, SDK guides, changelog migration notes and bug-report repro steps read; six such benign twins were authored and all six match the parameter-binding condition alone. (2) TWO OR MORE named parameter bindings within 300 characters, which is what makes the text a call spec rather than a sentence that happens to mention an argument. CHANNEL IS PART OF THE DETECTION, NOT AN ACCIDENT. agent_source.type is mcp_exchange, so EVENT_TYPE_TO_SOURCE routes only tool_response and tool_call events here and llm_input is never evaluated. That is load-bearing: a user who types "I would like you to call the geocode function with the parameter address set to ..." is making an ordinary direct request, and it matches both conditions. It is benign because of WHO said it, and the event type is the only place that fact exists. Do not widen this rule to llm_io.
+author: ATR Project
+date: 2026/08/24
+schema_version: '1.0'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  owasp_llm:
+    - LLM01:2025
+  owasp_agentic:
+    - ASI01:2026
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+    - AML.T0053 - LLM Plugin Compromise
+  papers:
+    - 'AutoDojo: automated variant generation for AgentDojo prompt-injection suites — repo: https://github.com/xhOwenMa/AutoDojo, agentdojo/variant_generation/variants/banking/anthropic/claude-haiku-4.5/no_defense/injections.json and banking_rlhammer.json'
+    - 'Debenedetti et al., AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (arXiv:2406.13352)'
+compliance:
+  nist_ai_rmf:
+    - subcategory: MS.2.7
+      context: A call specification planted in untrusted tool output is a prompt-injection payload aimed at the agent's action surface; MS.2.7 requires that resilience to such injection be evaluated and documented, and this rule supplies the runtime evidence.
+      strength: primary
+    - subcategory: MG.2.3
+      context: MG.2.3 requires mechanisms to disengage or override an AI system that behaves outside intended use; detecting dictated tool arguments is the trigger condition for that override before the call is issued.
+      strength: secondary
+    - subcategory: MS.1.1
+      context: MS.1.1 requires that risks be measured against intended use; a tool call whose arguments originate in retrieved third-party data is outside the agent's intended authority chain, which this rule makes measurable.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by detecting third-party content that attempts to originate the agent's tool calls.
+      strength: primary
+    - clause: 6.1.2
+      context: ISO/IEC 42001 Clause 6.1.2 (AI risk assessment) identifies untrusted-input-driven action as a treated risk; this rule is the corresponding detective control.
+      strength: secondary
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist third-party attempts to alter their use or outputs; a dictated tool call is a direct alteration of use, detected here before execution.
+      strength: primary
+    - article: '14'
+      context: Article 14 (human oversight) requires that a natural person can intervene before consequential automated action; flagging an externally dictated call spec is what creates that intervention point.
+      strength: secondary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for indirect prompt injection targeting tool invocation.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: dictated-tool-arguments
+  scan_target: content
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  conditions:
+    - field: content
+      operator: regex
+      value: (?:\bI\s+(?:would\s+like|want|need|am\s+asking)\s+(?:you|the\s+(?:assistant|agent|ai|model|bot))\s+to\s+(?:call|invoke|execute|run|trigger|use)\b|\b(?:can|could|would|will)\s+you\s+(?:please\s+)?(?:construct|build|create|assemble|prepare|produce|form)\b[^.\n]{0,80}?\b(?:argument|parameter)s?\b[^.\n]{0,80}?\b(?:call|invoke|execute|trigger)\b|\b(?:have|let|ask)\s+the\s+(?:assistant|agent|ai|model|bot)\s+(?:to\s+)?(?:call|invoke|execute|trigger)\b|\bthe\s+(?:assistant|agent|ai|model|bot)\s+(?:should|must|needs\s+to|is\s+to)\s+(?:call|invoke|execute|trigger)\s+the\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:function|tool|api|method|endpoint|command)\b)
+      description: The retrieved content asks an assistant/agent to construct and issue the call — the conjunct that separates a planted call spec from API reference documentation
+    - field: content
+      operator: regex
+      value: (?:\bthe\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:parameter|argument|field)\b|\b(?:parameter|argument|field)\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:\bset\s+to|=|\bas|\bto)\b|\bpassing\s+[^.\n]{0,60}?\bto\s+the\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:parameter|argument|field)\b)[\s\S]{0,300}?(?:\bthe\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:parameter|argument|field)\b|\b(?:parameter|argument|field)\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:\bset\s+to|=|\bas|\bto)\b|\bpassing\s+[^.\n]{0,60}?\bto\s+the\s+[A-Za-z_][A-Za-z0-9_]{1,40}\s+(?:parameter|argument|field)\b)
+      description: Two or more named parameter bindings within 300 chars, i.e. the text is a serialised call specification rather than prose mentioning an argument
+  condition: all
+  false_positives:
+    - A support ticket, bug report or vendor email in which a human legitimately asks the agent to run a specific tool with specific arguments. The text is indistinguishable; what differs is whether the requester is authorised, which is not a property of the content.
+    - Security research or vendor writing that quotes an AutoDojo banking/slack injection variant verbatim.
+    - Agent-framework tutorials retrieved as documentation that phrase an example as a request to the assistant.
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02817] A tool result contains a fully specified tool call — target function plus parameter-by-parameter argument bindings — addressed to the assistant. Arguments originating in retrieved third-party data must not be executed without human confirmation.

package/rules/tool-poisoning/ATR-2026-02864-non-canonical-ipv4-host-in-url-tool-argument.yaml

@@ -0,0 +1,102 @@
+title: Non-Canonical Numeric IPv4 Host in a URL-Typed Tool Argument (SSRF Filter Bypass)
+id: ATR-2026-02864
+rule_version: 1
+status: experimental
+description: |
+  Detects an agent or node tool call whose URL-typed argument names its host as a NON-CANONICAL numeric IPv4 literal: a bare decimal integer (http://2130706433/), a bare octal integer (http://017700000001/), a bare hex integer (http://0x7f000001/), a dotted address whose first part is octal or hex (http://0177.0.0.1/, http://0x7f.0.0.1/), or the two- and three-part short forms (http://127.1/, http://127.0.1/, http://10.1/). URL parsers and the OS resolver expand every one of these into an ordinary address such as 127.0.0.1, 10.0.0.1 or 169.254.169.254, but a deny-list that only recognises the four-part dotted-decimal spelling does not, so the request reaches loopback, LAN or cloud-metadata services the filter was meant to stop.
+  This is the bypass core of CVE-2026-101883 (OpenClaw Windows Node through 2026.9.4): the canvas.present capability skipped the URL risk evaluation that canvas.navigate enforced, and the regex-based check that did exist only matched dotted-decimal private ranges. Anyone with gateway or agent access could send canvas.present with {"url": "http://2130706433:8080/admin"} and make the node's WebView issue the request from the user's machine. The fix commit 16528aa added CanvasUrlSafety, whose tests enumerate exactly these encodings. The same parser differential applies to any URL-typed argument of any tool (fetch, browse, open_url, webhook targets), so the rule is not keyed to the canvas tool name.
+  SCOPE AND LIMITS, stated honestly. The rule matches only when the URL is a JSON string value with a quoted key ("url":"..."), a quoted element of a JSON array ({"urls":["..."]}), or the whole argument string, so prose that quotes the payload does not fire. A single trailing dot after the host (http://2130706433./) is accepted because WHATWG/Chromium URL parsers (the WebView2 used by the Windows node) drop the empty final label and still resolve it to 127.0.0.1. JSON-escaped slashes after the scheme (http:\/\/0x7f000001\/, as produced by PHP json_encode) are also accepted. It deliberately does NOT match canonical dotted-decimal loopback or private addresses (127.0.0.1, 10.x, 192.168.x), 0.0.0.0, the bare "0" host, or the 100.64.0.0/10 CGNAT / Tailscale range, even though the upstream fix blocks all of them: coding agents and node canvases legitimately open local dev servers, LAN devices and tailnet dashboards constantly, and those values are byte-for-byte the same shape as the attack. IPv4-mapped IPv6, [::1] and ULA ([fd00::1]) hosts are matched by ATR-2026-00013. That rule lists only a few hard-coded hex/octal loopback strings (0x7f000001, 0x7f.0x0.0x0.0x1, 017700000001 and similar), so the overlap is limited to those exact strings; general hex forms such as http://0x7f.1:9222/ are not matched by ATR-2026-00013 (its own evasion_tests list 0x7f.1 as a gap) and are covered here. Unicode full-width dots, percent-encoded hosts, zero-padded dotted-decimal octets (http://127.000.000.001/), scheme-relative URLs (//2130706433/) and DNS names that resolve to internal addresses are out of scope.
+  CWE-918 (Server-Side Request Forgery), CWE-1286 (Improper Validation of Syntactic Correctness of Input).
+author: ATR Community (CVE sync)
+date: 2026/10/22
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-101883
+  ghsa:
+    - GHSA-7vch-pmw9-3g4q
+  euvd:
+    - EUVD-2026-90256
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI02:2026
+  mitre_atlas:
+    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0053 - AI Agent Tool Invocation
+  mitre_attack:
+    - T1090 - Proxy
+    - T1046 - Network Service Discovery
+  external:
+    - https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-7vch-pmw9-3g4q
+    - https://github.com/openclaw/openclaw-windows-node/commit/16528aadaa45d7bc6718b07ccf8b01f3eb033ad1
+    - https://www.vulncheck.com/advisories/openclaw-windows-node-through-2026.9.4-ssrf-via-canvas-present
+    - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90256
+metadata_provenance:
+  cve: human-reviewed
+  ghsa: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_atlas: human-reviewed
+  mitre_attack: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 requires accuracy, robustness and cybersecurity appropriate to the intended purpose. A URL argument whose host is spelled as a decimal, octal or short-form IPv4 literal is a known way to slip past a dotted-decimal deny-list; this rule provides detection evidence supporting the Article 15 robustness obligation at the agent-to-tool boundary while the receiving tool remains unpatched.
+      strength: primary
+    - article: '9'
+      context: Article 9 risk management must account for the network reach an agent's tools give it. Runtime evidence that tool calls are steering a node's browser or fetcher at encoded internal addresses feeds the risk register for that surface.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Measure
+      subcategory: MS.2.7
+      context: MS.2.7 requires AI system security and resilience to be evaluated and documented. Inspecting each URL-typed tool argument for non-canonical IPv4 host encodings is a measurable, per-invocation control against SSRF filter bypass rather than an assumption that every tool canonicalises hosts correctly.
+      strength: primary
+    - function: Manage
+      subcategory: MG.3.2
+      context: MG.3.2 requires pre-trained models and third-party components to be monitored. Node capabilities and MCP tools that fetch URLs are third-party components whose host validation the deployer cannot audit; flagging encoded internal hosts in their arguments is the monitoring control.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational planning and control covers the tools an AI system invokes. This rule is an operational control applied to every URL-typed tool argument, independent of the tool's own URL validation.
+      strength: primary
+    - clause: '8.3'
+      context: Clause 8.3 AI risk treatment requires controls proportionate to identified risks. Because one encoded host can expose loopback admin panels or cloud metadata from the user's machine, inspecting URL hosts at call time is a proportionate treatment.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: ssrf-encoded-ip-host
+  scan_target: tool_args
+  confidence: medium
+  source: cve-disclosure
+  vendor_sources: openclaw-windows-node-cve-2026-101883
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  method: pattern
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: (?:^|\\?"[A-Za-z_][A-Za-z0-9_.-]{0,40}\\?"\s{0,3}:\s{0,3}\\?"|[\[,]\s{0,3}\\?")(?:https?|wss?|ftp):\\?/\\?/(?:[^/\s"\x27@?#\\]{1,64}@)?(?:\d{8,10}|0[0-7]{8,11}|0x[0-9a-f]{1,8}|0(?:[0-7]{1,3}|x[0-9a-f]{1,2})(?:\.(?:0x[0-9a-f]{1,2}|\d{1,4})){1,3}|\d{1,3}\.\d{1,8}|\d{1,3}\.\d{1,3}\.\d{1,5})\.?(?:[:/?#"\x27\\\s\]]|$)
+      description: A URL that is a quoted JSON value, a quoted JSON array element (or the whole argument) whose host is a decimal integer, octal integer, hex integer, octal/hex-first-part dotted address, or a two/three-part short IPv4 form - every spelling that resolves to an IPv4 address while evading a dotted-decimal deny-list
+  false_positives:
+    - Security test suites, SSRF fuzzing harnesses and CVE reproductions that deliberately pass encoded hosts in a URL argument will match; that is the intended behaviour for a detection corpus.
+    - A serialized tool call or JSON document quoted verbatim inside an article is the same bytes as the attack and still matches. Prose that mentions the URL without a quoted key does not.
+    - Embedded or industrial devices whose documentation tells users to reach them by a short-form address (http://10.1/) would match; this is rare and the short form is itself a canonicalisation hazard.
+response:
+  actions:
+    - alert
+    - snapshot
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): new rule with no benign-corpus FP measurement beyond the gate; ceiling = observe.'
+  auto_response_threshold: high
+  message_template: |
+    [ATR-2026-02864] HIGH: a URL-typed tool argument names its host as a non-canonical numeric IPv4 literal (decimal / octal / hex integer, octal or hex dotted part, or short form). These spellings resolve to internal addresses such as 127.0.0.1 or 169.254.169.254 while slipping past dotted-decimal deny-lists - the CVE-2026-101883 canvas.present SSRF bypass. Canonicalise the host before applying URL policy.
+confidence: 72

package/rules/tool-poisoning/ATR-2026-02865-read-only-utility-write-flag-in-command-argument.yaml

@@ -0,0 +1,157 @@
+title: Read-Only Allow-Listed Utility Invoked With a File-Write or State-Changing Option in a Command Argument
+id: ATR-2026-02865
+rule_version: 1
+status: experimental
+description: |
+  Detects an agent or MCP tool call whose command-string argument starts with a utility that command allow-lists commonly classify as read-only (sort, uniq, diff, date, hostname, file) and gives it the option or operand that makes the utility itself write a file, run a helper program, or change system state. No shell metacharacter is involved: the allowed binary opens the destination on its own, so filters that only look for ; | && $( ) never see it.
+  This is the shape reported as CVE-2026-105789 / GHSA-85w2-wggf-rw49 against Microsoft UFO before 3.0.9. The execute_command tool of the Linux MCP server (ufo/client/mcp/http_servers/linux_mcp_server.py) accepted a free-form command string and allowed sort and uniq as read-only commands, so 'sort -o <file>' or the optional second uniq operand created or overwrote any file writable by the server process (agent configuration, shell startup files). The fix (commit 4f79362) removed sort and added per-command argument policies; its regression tests (tests/test_linux_mcp_command_policy.py) list the rejected forms used here. The command string is produced by the model, so a prompt injection that steers the next tool call is enough to reach it.
+  Six layers, each one utility's state-changing form: (1) sort with -o / an -o short-option cluster / --output (and its unique prefixes --o, --out ...), or --compress-program naming anything other than a real compressor (gzip, pigz, bzip2, xz, lz4, zstd, ...): sort executes that program, which turns a read-only allow-list entry into code execution; (2) diff with --output / --out / -o; (3) uniq with two non-option operands, where the second is the output file; option arguments of -f / -s / -w are consumed so 'uniq -f 2 data.txt' is not read as two operands; (4) date with -s / --set (and --se, --s) or a bare operand that is a valid MMDDhhmm[[CC]YY][.ss] timestamp (month 01-12, day 01-31, hour 00-23, minute 00-59), both of which set the system clock; a YYYYMMDD string such as 'date 20261022' is not a valid month and does not match; (5) hostname given a new name as its only operand, or -F / --file; (6) file with --compile (or its unique prefixes --co, --comp ...), which writes a compiled magic database (.mgc) into the working directory.
+  Scope and limits: the utility must be the FIRST token of a JSON string value whose key is command-like: command, cmd, cmd_line, command_line, cmdline, commandline, shell, script, exec, args, argv, optionally prefixed by a word ending in '_' or '-' (bash_command, shell_cmd) or by bash, shell, sh, run, exec, raw or full (shellCommand, runCmd). Keys that merely end in those letters (transcript, subscript) do not count. The utility may be prefixed by sudo or a /usr/bin, /bin or ./ path. A JSON-escaped tab (\t) between tokens is treated as whitespace, because the shell splits on it; an escaped newline is not, because it ends the command. Commands reached after a pipe, ';', '&&' or a newline, passed as an argv array, or wrapped by env / nice / timeout are out of scope (shell-metacharacter rules cover the chained forms). file -C cannot be told apart from the read-only file -c because the engine matches case-insensitively, so only the long --compile form is covered. file -z / --uncompress, which the same fix also rejects, is not covered: it runs only libmagic's fixed decompressor list, not an attacker-chosen program, and 'file -z archive.gz' is ordinary read-only use. uniq operands that are quoted are not matched. CWE-88, CWE-184.
+  RE2 portability: every condition compiles under RE2 (checked with Go regexp). The earlier lookarounds were replaced without changing behaviour: trailing lookaheads now consume the terminator, the uniq option/operand lookaheads became explicit alternatives, and the --compress-program compressor exception became a positive witness generated from the compressor/path trie. Measured equivalent to the lookaround version on 2.4M generated command strings and an exhaustive 1.48M-string sweep of the --compress-program value forms. The trade-off is size: Layer 1 is about 2.4 KB because a finite exception list has no short RE2 spelling.
+  Known false positive: in a general-purpose shell tool where writing files is allowed, the ordinary write forms of these utilities match exactly like the attack, for example 'sort -o sorted.txt data.txt', in-place sorting with 'sort -u -o names.txt names.txt', and 'uniq -c sorted.txt counts.txt'. The rule reports that a read-only-looking utility was used to write, not intent, which is why severity is medium and the response is observe-only.
+author: ATR Community (CVE sync)
+date: 2026/10/22
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: medium
+references:
+  cve:
+    - CVE-2026-105789
+  ghsa:
+    - GHSA-85w2-wggf-rw49
+  cwe:
+    - CWE-88
+    - CWE-184
+  owasp_llm:
+    - LLM06:2025
+    - LLM03:2025
+  owasp_agentic:
+    - ASI02:2026
+    - ASI05:2026
+    - ASI04:2026
+  mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
+  mitre_attack:
+    - 'T1565.001 - Data Manipulation: Stored Data Manipulation'
+    - 'T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification'
+    - T1202 - Indirect Command Execution
+  external:
+    - https://github.com/microsoft/UFO/security/advisories/GHSA-85w2-wggf-rw49
+    - https://github.com/microsoft/UFO/pull/349
+    - https://github.com/microsoft/UFO/commit/4f793622794f5d47810d54bed431c61f6a781dd6
+    - https://github.com/microsoft/UFO/releases/tag/v3.0.9
+    - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93406
+metadata_provenance:
+  cve: euvd-sync
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_atlas: human-reviewed
+  mitre_attack: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 requires cybersecurity appropriate to the intended purpose. An agent whose command tool trusts sort, uniq, diff, date, hostname or file as read-only can be steered into overwriting its own configuration or changing system state; flagging those utilities' write and set forms provides detection evidence supporting Article 15 robustness at the agent-to-OS boundary.
+      strength: primary
+    - article: '9'
+      context: Article 9 risk management must identify how an agent's tools can be misused. Matches from this rule provide detection evidence supporting Article 9 by showing when a command allow-list's read-only classification was exceeded through a utility's own options, a risk that first-token allow-lists do not capture.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Measure
+      subcategory: MS.2.7
+      context: MS.2.7 requires security and resilience to be evaluated and documented. Inspecting each command-tool invocation for file-write and state-changing options of allow-listed utilities is a measurable per-call control rather than an assumption that the allow-list is complete.
+      strength: primary
+    - function: Manage
+      subcategory: MG.3.2
+      context: MG.3.2 covers monitoring of third-party components in operation. The vulnerable execute_command tool ships with an agent framework the deployer did not write; monitoring the commands it actually receives is the operational check on that component.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational control over externally provided processes covers the MCP servers an agent invokes. This rule is applied to every command those servers receive, independent of the server's own argument policy.
+      strength: primary
+    - clause: '8.3'
+      context: Clause 8.3 AI risk treatment requires controls proportionate to the risk. Because one sort -o can overwrite the agent's own configuration, runtime detection of the write form is a proportionate treatment alongside upgrading the framework.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: read-only-utility-write-option
+  scan_target: tool_args
+  confidence: medium
+  source: cve-disclosure
+  vendor_sources: microsoft-ufo-cve-2026-105789
+agent_source:
+  type: mcp_exchange
+  framework:
+    - mcp
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  method: pattern
+  false_positives:
+    - 'Known false positive: a general-purpose shell tool where the user genuinely asks the agent to write sorted or de-duplicated output to a file produces the same tool call as the attack, for example sort -o sorted.txt data.txt, in-place sort -u -o names.txt names.txt, or uniq -c sorted.txt counts.txt. The rule cannot tell intent; it reports that a utility commonly allow-listed as read-only was used in its write form.'
+    - Administrative agents that are meant to set the clock or hostname (date -s, hostname new-name) will match.
+    - Building a custom magic database with file -C -m magic --compile in a development shell will match.
+    - Security test suites and CVE reproductions that pass these command strings to a tool will match, which is intended for a detection corpus.
+  conditions:
+    - field: content
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?sort(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>]{1,80}){0,8}?(?:\s|\\(?:\\\\?)?t){1,64}(?:(?:-[bcdfghimnrsuvz]{0,8}o(?:\s|\\(?:\\\\?)?t){0,64}|--o(?:u(?:t(?:p(?:u(?:t)?)?)?)?)?(?:=|(?:\s|\\(?:\\\\?)?t){1,64}))(?:\\{1,7}"|')?[^\s"\\|;&<>{}\[\],-]|--co[a-z-]{0,16}(?:=|(?:\s|\\(?:\\\\?)?t){1,64})(?:'(?:[^/bglpxz]|$)|\\{1,7}"[^\s"\\|;&<>{}\[\],/bglpxz-]|[^\s"\\|;&<>{}\[\],'/bglpxz-]|(?:'|\\{1,7}")?(?:/(?:usr/)?(?:local/)?s?bin/(?:[^bglpxz]|$|b(?:[^rz]|$|r(?:[^o]|$|o(?:[^t]|$|t(?:[^l]|$|l(?:[^i]|$))))|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|g(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$)))|l(?:[^bz]|$|b(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|z(?:[^4imo]|$|i(?:[^p]|$)|m(?:[^a]|$)|o(?:[^p]|$)))|p(?:[^bilxz]|$|b(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|i(?:[^g]|$|g(?:[^z]|$))|l(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$)))|x(?:[^z]|$)|z(?:[^s]|$|s(?:[^t]|$|t(?:[^d]|$))))|x(?:[^z]|$)|z(?:[^s]|$|s(?:[^t]|$|t(?:[^d]|$)))|(?:gzip|pigz|bzip2|pbzip2|lbzip2|xz|pxz|lz4|lzop|zstd|pzstd|lzma|lzip|plzip|brotli)(?:[^\s'"\\]|\\{8}|\\{1,7}(?:[^"\\t]|$)|\\{4,7}t))|/(?:[^blsu]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))|l(?:[^o]|$|o(?:[^c]|$|c(?:[^a]|$|a(?:[^l]|$|l(?:[^/]|$|/(?:[^bs]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))|s(?:[^b]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$))))))))))|s(?:[^b]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$))))|u(?:[^s]|$|s(?:[^r]|$|r(?:[^/]|$|/(?:[^bls]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))|l(?:[^o]|$|o(?:[^c]|$|c(?:[^a]|$|a(?:[^l]|$|l(?:[^/]|$|/(?:[^bs]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))|s(?:[^b]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$))))))))))|s(?:[^b]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))))))))|(?:b(?:[^rz]|$|r(?:[^o]|$|o(?:[^t]|$|t(?:[^l]|$|l(?:[^i]|$))))|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|g(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$)))|l(?:[^bz]|$|b(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|z(?:[^4imo]|$|i(?:[^p]|$)|m(?:[^a]|$)|o(?:[^p]|$)))|p(?:[^bilxz]|$|b(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|i(?:[^g]|$|g(?:[^z]|$))|l(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$)))|x(?:[^z]|$)|z(?:[^s]|$|s(?:[^t]|$|t(?:[^d]|$))))|x(?:[^z]|$)|z(?:[^s]|$|s(?:[^t]|$|t(?:[^d]|$)))|(?:gzip|pigz|bzip2|pbzip2|lbzip2|xz|pxz|lz4|lzop|zstd|pzstd|lzma|lzip|plzip|brotli)(?:[^\s'"\\]|\\{8}|\\{1,7}(?:[^"\\t]|$)|\\{4,7}t)))))
+      description: sort invoked with an output file (-o / --output) or with --compress-program naming a non-compressor program - sort writes or executes it itself (CVE-2026-105789 primary primitive)
+    - field: tool_args
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?sort(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>]{1,80}){0,8}?(?:\s|\\(?:\\\\?)?t){1,64}(?:(?:-[bcdfghimnrsuvz]{0,8}o(?:\s|\\(?:\\\\?)?t){0,64}|--o(?:u(?:t(?:p(?:u(?:t)?)?)?)?)?(?:=|(?:\s|\\(?:\\\\?)?t){1,64}))(?:\\{1,7}"|')?[^\s"\\|;&<>{}\[\],-]|--co[a-z-]{0,16}(?:=|(?:\s|\\(?:\\\\?)?t){1,64})(?:'(?:[^/bglpxz]|$)|\\{1,7}"[^\s"\\|;&<>{}\[\],/bglpxz-]|[^\s"\\|;&<>{}\[\],'/bglpxz-]|(?:'|\\{1,7}")?(?:/(?:usr/)?(?:local/)?s?bin/(?:[^bglpxz]|$|b(?:[^rz]|$|r(?:[^o]|$|o(?:[^t]|$|t(?:[^l]|$|l(?:[^i]|$))))|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|g(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$)))|l(?:[^bz]|$|b(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|z(?:[^4imo]|$|i(?:[^p]|$)|m(?:[^a]|$)|o(?:[^p]|$)))|p(?:[^bilxz]|$|b(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|i(?:[^g]|$|g(?:[^z]|$))|l(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$)))|x(?:[^z]|$)|z(?:[^s]|$|s(?:[^t]|$|t(?:[^d]|$))))|x(?:[^z]|$)|z(?:[^s]|$|s(?:[^t]|$|t(?:[^d]|$)))|(?:gzip|pigz|bzip2|pbzip2|lbzip2|xz|pxz|lz4|lzop|zstd|pzstd|lzma|lzip|plzip|brotli)(?:[^\s'"\\]|\\{8}|\\{1,7}(?:[^"\\t]|$)|\\{4,7}t))|/(?:[^blsu]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))|l(?:[^o]|$|o(?:[^c]|$|c(?:[^a]|$|a(?:[^l]|$|l(?:[^/]|$|/(?:[^bs]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))|s(?:[^b]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$))))))))))|s(?:[^b]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$))))|u(?:[^s]|$|s(?:[^r]|$|r(?:[^/]|$|/(?:[^bls]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))|l(?:[^o]|$|o(?:[^c]|$|c(?:[^a]|$|a(?:[^l]|$|l(?:[^/]|$|/(?:[^bs]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))|s(?:[^b]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$))))))))))|s(?:[^b]|$|b(?:[^i]|$|i(?:[^n]|$|n(?:[^/]|$)))))))))|(?:b(?:[^rz]|$|r(?:[^o]|$|o(?:[^t]|$|t(?:[^l]|$|l(?:[^i]|$))))|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|g(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$)))|l(?:[^bz]|$|b(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|z(?:[^4imo]|$|i(?:[^p]|$)|m(?:[^a]|$)|o(?:[^p]|$)))|p(?:[^bilxz]|$|b(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$|p(?:[^2]|$))))|i(?:[^g]|$|g(?:[^z]|$))|l(?:[^z]|$|z(?:[^i]|$|i(?:[^p]|$)))|x(?:[^z]|$)|z(?:[^s]|$|s(?:[^t]|$|t(?:[^d]|$))))|x(?:[^z]|$)|z(?:[^s]|$|s(?:[^t]|$|t(?:[^d]|$)))|(?:gzip|pigz|bzip2|pbzip2|lbzip2|xz|pxz|lz4|lzop|zstd|pzstd|lzma|lzip|plzip|brotli)(?:[^\s'"\\]|\\{8}|\\{1,7}(?:[^"\\t]|$)|\\{4,7}t)))))
+      description: Same as Layer 1, in the JSON-encoded tool argument object
+    - field: content
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?diff(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>]{1,80}){0,8}?(?:\s|\\(?:\\\\?)?t){1,64}(?:-[abcehnpqrtuvwyz]{0,6}o(?:\s|\\(?:\\\\?)?t){0,64}|--out(?:p(?:u(?:t)?)?)?(?:=|(?:\s|\\(?:\\\\?)?t){1,64}))(?:\\{1,7}"|')?[^\s"\\|;&<>{}\[\],-]
+      description: diff invoked with an output file (--output / --out / -o) - diff writes the destination itself
+    - field: tool_args
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?diff(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>]{1,80}){0,8}?(?:\s|\\(?:\\\\?)?t){1,64}(?:-[abcehnpqrtuvwyz]{0,6}o(?:\s|\\(?:\\\\?)?t){0,64}|--out(?:p(?:u(?:t)?)?)?(?:=|(?:\s|\\(?:\\\\?)?t){1,64}))(?:\\{1,7}"|')?[^\s"\\|;&<>{}\[\],-]
+      description: Same as Layer 2, in the JSON-encoded tool argument object
+    - field: content
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?uniq(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>{}\[\],-][^\s"\\|;&<>]{0,200}|(?:(?:\s|\\(?:\\\\?)?t){1,64}(?:--|-[a-z\d]{1,6}(?:(?:\s|\\(?:\\\\?)?t){1,64}\d{1,6})?|--[a-z][a-z-]{1,20}(?:=[\w-]{0,20}|(?:\s|\\(?:\\\\?)?t){1,64}\d{1,6})?)){0,5}(?:\s|\\(?:\\\\?)?t){1,64}(?:(?:-[a-z\d]{1,6}|--[a-z][a-z-]{1,20})(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>{}\[\],\d-][^\s"\\|;&<>]{0,200}|(?:--|-[a-z\d]{1,6}(?:\s|\\(?:\\\\?)?t){1,64}\d{1,6}|--[a-z][a-z-]{1,20}(?:=[\w-]{0,20}|(?:\s|\\(?:\\\\?)?t){1,64}\d{1,6}))(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>{}\[\],-][^\s"\\|;&<>]{0,200}))(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>{}\[\],-][^\s"\\|;&<>]{0,200}(?:(?:\s|\\(?:\\\\?)?t)|\\{0,7}"|$)
+      description: uniq given an input and an output operand - uniq creates or overwrites the second file itself
+    - field: tool_args
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?uniq(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>{}\[\],-][^\s"\\|;&<>]{0,200}|(?:(?:\s|\\(?:\\\\?)?t){1,64}(?:--|-[a-z\d]{1,6}(?:(?:\s|\\(?:\\\\?)?t){1,64}\d{1,6})?|--[a-z][a-z-]{1,20}(?:=[\w-]{0,20}|(?:\s|\\(?:\\\\?)?t){1,64}\d{1,6})?)){0,5}(?:\s|\\(?:\\\\?)?t){1,64}(?:(?:-[a-z\d]{1,6}|--[a-z][a-z-]{1,20})(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>{}\[\],\d-][^\s"\\|;&<>]{0,200}|(?:--|-[a-z\d]{1,6}(?:\s|\\(?:\\\\?)?t){1,64}\d{1,6}|--[a-z][a-z-]{1,20}(?:=[\w-]{0,20}|(?:\s|\\(?:\\\\?)?t){1,64}\d{1,6}))(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>{}\[\],-][^\s"\\|;&<>]{0,200}))(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>{}\[\],-][^\s"\\|;&<>]{0,200}(?:(?:\s|\\(?:\\\\?)?t)|\\{0,7}"|$)
+      description: Same as Layer 3, in the JSON-encoded tool argument object
+    - field: content
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?date(?:(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>]{1,80}){0,8}?(?:\s|\\(?:\\\\?)?t){1,64}(?:-u?s(?:\s|\\(?:\\\\?)?t){0,64}|--s(?:et?)?(?:=|(?:\s|\\(?:\\\\?)?t){1,64}))(?:\\{1,7}"|')?[^\s"\\|;&<>{}\[\],-]|(?:(?:\s|\\(?:\\\\?)?t){1,64}(?:-u|--utc|--universal)){0,3}(?:\s|\\(?:\\\\?)?t){1,64}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])(?:[01]\d|2[0-3])[0-5]\d(?:\d{2}){0,2}(?:\.\d{2})?(?:(?:\s|\\(?:\\\\?)?t)|\\{0,7}"|$))
+      description: date invoked with -s / --set or a valid MMDDhhmm operand - both set the system clock
+    - field: tool_args
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?date(?:(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>]{1,80}){0,8}?(?:\s|\\(?:\\\\?)?t){1,64}(?:-u?s(?:\s|\\(?:\\\\?)?t){0,64}|--s(?:et?)?(?:=|(?:\s|\\(?:\\\\?)?t){1,64}))(?:\\{1,7}"|')?[^\s"\\|;&<>{}\[\],-]|(?:(?:\s|\\(?:\\\\?)?t){1,64}(?:-u|--utc|--universal)){0,3}(?:\s|\\(?:\\\\?)?t){1,64}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])(?:[01]\d|2[0-3])[0-5]\d(?:\d{2}){0,2}(?:\.\d{2})?(?:(?:\s|\\(?:\\\\?)?t)|\\{0,7}"|$))
+      description: Same as Layer 4, in the JSON-encoded tool argument object
+    - field: content
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?hostname(?:(?:\s|\\(?:\\\\?)?t){1,64}(?:-[bv]{1,2}|--boot|--verbose)){0,3}(?:\s|\\(?:\\\\?)?t){1,64}(?:(?:-[bv]{0,2}f(?:\s|\\(?:\\\\?)?t){0,64}|--fi(?:le?)?(?:=|(?:\s|\\(?:\\\\?)?t){1,64}))(?:\\{1,7}"|')?[^\s"\\|;&<>{}\[\],-]|[a-z0-9][a-z0-9.-]{0,252}(?:\s|\\(?:\\\\?)?t){0,16}(?:\\{0,7}"|$))
+      description: hostname given a new name or a name file - hostname changes the system hostname
+    - field: tool_args
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?hostname(?:(?:\s|\\(?:\\\\?)?t){1,64}(?:-[bv]{1,2}|--boot|--verbose)){0,3}(?:\s|\\(?:\\\\?)?t){1,64}(?:(?:-[bv]{0,2}f(?:\s|\\(?:\\\\?)?t){0,64}|--fi(?:le?)?(?:=|(?:\s|\\(?:\\\\?)?t){1,64}))(?:\\{1,7}"|')?[^\s"\\|;&<>{}\[\],-]|[a-z0-9][a-z0-9.-]{0,252}(?:\s|\\(?:\\\\?)?t){0,16}(?:\\{0,7}"|$))
+      description: Same as Layer 5, in the JSON-encoded tool argument object
+    - field: content
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?file(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>]{1,80}){0,8}?(?:\s|\\(?:\\\\?)?t){1,64}--co(?:m(?:p(?:i(?:l(?:e)?)?)?)?)?(?:(?:\s|\\(?:\\\\?)?t)|\\{0,7}"|$)
+      description: file invoked with --compile - file writes a compiled magic database into the working directory
+    - field: tool_args
+      operator: regex
+      value: \\{0,7}"(?:\w{0,24}?[_-]|bash|shell|sh|run|exec|raw|full)?(?:command_line|commandline|cmd_line|cmdline|command|cmd|shell|script|exec|args?|argv)\\{0,7}"\s*:\s*\\{0,7}"\s{0,16}(?:sudo(?:\s|\\(?:\\\\?)?t){1,64})?(?:/(?:usr/)?(?:local/)?s?bin/|\./)?file(?:(?:\s|\\(?:\\\\?)?t){1,64}[^\s"\\|;&<>]{1,80}){0,8}?(?:\s|\\(?:\\\\?)?t){1,64}--co(?:m(?:p(?:i(?:l(?:e)?)?)?)?)?(?:(?:\s|\\(?:\\\\?)?t)|\\{0,7}"|$)
+      description: Same as Layer 6, in the JSON-encoded tool argument object
+response:
+  actions:
+    - alert
+    - snapshot
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): new rule with no FP measurement on the 65K benign corpus and a documented false positive on ordinary write forms in general-purpose shell tools; ceiling = observe. No block action.'
+  auto_response_threshold: high
+  notify:
+    - security_team
+  message_template: |
+    [ATR-2026-02865] MEDIUM: a command tool argument uses a utility that command allow-lists commonly treat as read-only (sort, uniq, diff, date, hostname, file) in a form that writes a file, runs a helper program or changes system state. This is the CVE-2026-105789 (Microsoft UFO execute_command) pattern. In a general-purpose shell tool this can be an ordinary write; check whether the tool is meant to be read-only and enforces a per-command argument policy, and upgrade UFO to 3.0.9 or later.
+confidence: 60