Potential Prompt Injection Coercing Shell Execution

  1[metadata]
  2creation_date = "2026/10/09"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/10/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects shells or scripting interpreters launched from a parent command line that contains common LLM prompt-injection
 11or jailbreak language. Attackers (or malicious content ingested by an agent) use instruction-override, DAN/developer-
 12mode, system-prompt extraction, and safety-filter bypass phrasing to coerce GenAI coding agents and automation wrappers
 13into running attacker-chosen commands. When that injected text reaches a child shell or interpreter, it is a strong
 14signal that untrusted prompt content is crossing into local code execution, enabling credential theft, data
 15exfiltration, persistence, or further tool abuse under the user's privileges.
 16"""
 17false_positives = [
 18    """
 19    Approved red-team, evaluation, or detection-engineering tests that deliberately include jailbreak strings (such as
 20    DAN or "ignore previous instructions") in prompts or regex experiments run through GenAI agent shells. Exclude known
 21    lab hosts or lower severity after validation.
 22    """,
 23    """
 24    Documentation that mentions "developer mode", "jailbreak", or "without restrictions" in a non-adversarial context.
 25    Review the full parent and child command lines before escalating.
 26    """,
 27]
 28from = "now-9m"
 29index = ["logs-endpoint.events.process-*"]
 30language = "eql"
 31license = "Elastic License v2"
 32name = "Potential Prompt Injection Coercing Shell Execution"
 33note = """## Triage and analysis
 34
 35### Investigating Potential Prompt Injection Coercing Shell Execution
 36
 37A shell or scripting interpreter started with a parent command line that matched common jailbreak /
 38instruction-override language (for example "ignore previous instructions", DAN/"Do Anything Now", or
 39"bypass the safety filter"). This can indicate a GenAI agent or wrapper being coerced by untrusted prompt
 40text into local code execution. The alert is a content heuristic on command-line text — confirm whether the
 41strings are adversarial injection versus security testing or documentation.
 42
 43### Possible investigation steps
 44
 45- Review `process.parent.command_line` and `process.command_line` for the matched jailbreak phrases and the
 46  surrounding payload (paths, URLs, credentials, download/execute patterns).
 47- Identify the parent process tree (`process.parent.name`, `process.parent.executable`) and whether it is a
 48  known GenAI client (Claude, Cursor, Codex, Copilot, Windsurf, etc.) or a shell-snapshot wrapper.
 49- Correlate with other GenAI-related alerts on the same `host.id` / `user.name` in the same window
 50  (unsafe permission bypass, suspicious shell via GenAI client, credential-path access).
 51- Check recent GenAI config or MCP changes and any outbound network activity from the same process tree.
 52- Determine whether the activity aligns with approved red-team / detection-engineering work.
 53
 54### False positive analysis
 55
 56- Approved red-team, evaluation, or detection-engineering tests that deliberately include jailbreak
 57  strings. Exclude known lab hosts or users.
 58- Claude Code / similar agents wrap user commands in `zsh -c` / `bash -c` shell-snapshots, so the phrase may
 59  appear in both parent and child command lines for a single user action.
 60
 61### Response and remediation
 62
 63- If not an approved test, isolate the host/user session, review the GenAI conversation or agent history for
 64  the injection source, and rotate credentials accessible to that user.
 65- Audit GenAI tool configs, MCP servers, and skills loaded during the session.
 66- Block or restrict the responsible agent/automation if compromise or successful coercion is confirmed.
 67"""
 68references = [
 69    "https://cymulate.com/blog/cve-2025-547954-54795-claude-inverseprompt/",
 70    "https://specterops.io/blog/2025/11/21/an-evening-with-claude-code/",
 71    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
 72]
 73risk_score = 47
 74rule_id = "30cb6dea-ce4d-4685-bd6c-9ff5b1904781"
 75severity = "medium"
 76tags = [
 77    "Domain: Endpoint",
 78    "Domain: GenAI",
 79    "OS: Linux",
 80    "OS: macOS",
 81    "OS: Windows",
 82    "Use Case: Threat Detection",
 83    "Tactic: Execution",
 84    "Tactic: Defense Evasion",
 85    "Data Source: Elastic Defend",
 86    "Resources: Investigation Guide",
 87    "Threat: Unauthorized AI Usage",
 88    "Rule Type: Event Correlation (EQL)",
 89    "Platform: Windows",
 90    "Platform: Linux",
 91    "Platform: macOS",
 92    "Mitre Atlas: AML.T0051",
 93    "Mitre Atlas: AML.T0054",
 94]
 95timestamp_override = "event.ingested"
 96type = "eql"
 97
 98query = '''
 99process where event.type == "start" and event.action in ("exec", "start") and
100(
101  process.name like~ (
102    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "mksh",
103    "timeout", "env", "bun",
104    "bash.exe", "sh.exe", "env.exe", "timeout.exe", "bun.exe",
105    "cmd.exe", "powershell.exe", "pwsh", "pwsh.exe", "powershell_ise.exe",
106    "osascript",
107    "wscript.exe", "cscript.exe", "mshta.exe"
108  ) or
109  ?process.pe.original_file_name in (
110    "Cmd.Exe", "PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE",
111    "wscript.exe", "cscript.exe", "MSHTA.EXE"
112  ) or
113  process.name like~ (
114    ".*",
115    "python*", "perl*", "php*", "ruby*", "lua*", "node*", "deno*"
116  )
117) and
118process.parent.command_line : (
119  "*ignore previous instructions*", "*ignore prior instructions*",
120  "*ignore all previous*", "*ignore your previous*",
121  "*ignore the content policy*",
122  "*disregard previous instructions*", "*disregard prior instructions*",
123  "*disregard all previous*",
124  "*disregard your system instructions*", "*disregard the system instructions*",
125  "*disregard all system instructions*",
126  "*disregard your developer instructions*", "*disregard the developer instructions*",
127  "*dan mode*", "*stan mode*", "*aim mode*", "*dude mode*",
128  "*do anything now*", "*you are dan*",
129  "*bypass the safety*", "*bypass the safety filter*", "*bypass safety filter*",
130  "*bypass the content filter*", "*bypass content filter*",
131  "*bypass the content policy*", "*bypass content policy*",
132  "*bypass your guidelines*",
133  "*no safety filter*", "*no content restriction*",
134  "*without any restrictions*", "*without your restrictions*",
135  "*without content restrictions*", "*without safety restrictions*",
136  "*unrestricted ai*", "*unrestricted developer mode*",
137  "*jailbreak the*", "*jailbreak mode *", "*jailbreak mode,*", "*jailbreak mode.*",
138  "*jailbreak mode!*", "*jailbreak prompt*",
139  "*forget everything you were told*", "*forget previous instructions*",
140  "*you are now in*developer mode*",
141  "*override your safety*",
142  "*hidden system prompt*",
143  "*reveal your system prompt*", "*reveal the system prompt*",
144  "*dump your system prompt*", "*dump the system prompt*",
145  "*print your system prompt*", "*print the system prompt*",
146  "*show your system prompt*", "*show the system prompt*",
147  "*override your system prompt*", "*override the system prompt*"
148)
149'''
150
151
152[[rule.threat]]
153framework = "MITRE ATT&CK"
154[[rule.threat.technique]]
155id = "T1059"
156name = "Command and Scripting Interpreter"
157reference = "https://attack.mitre.org/techniques/T1059/"
158[[rule.threat.technique.subtechnique]]
159id = "T1059.001"
160name = "PowerShell"
161reference = "https://attack.mitre.org/techniques/T1059/001/"
162
163[[rule.threat.technique.subtechnique]]
164id = "T1059.002"
165name = "AppleScript"
166reference = "https://attack.mitre.org/techniques/T1059/002/"
167
168[[rule.threat.technique.subtechnique]]
169id = "T1059.003"
170name = "Windows Command Shell"
171reference = "https://attack.mitre.org/techniques/T1059/003/"
172
173[[rule.threat.technique.subtechnique]]
174id = "T1059.004"
175name = "Unix Shell"
176reference = "https://attack.mitre.org/techniques/T1059/004/"
177
178[[rule.threat.technique.subtechnique]]
179id = "T1059.005"
180name = "Visual Basic"
181reference = "https://attack.mitre.org/techniques/T1059/005/"
182
183[[rule.threat.technique.subtechnique]]
184id = "T1059.006"
185name = "Python"
186reference = "https://attack.mitre.org/techniques/T1059/006/"
187
188[[rule.threat.technique.subtechnique]]
189id = "T1059.007"
190name = "JavaScript"
191reference = "https://attack.mitre.org/techniques/T1059/007/"
192
193
194[rule.threat.tactic]
195id = "TA0002"
196name = "Execution"
197reference = "https://attack.mitre.org/tactics/TA0002/"
198[[rule.threat_mappings]]
199framework = "MITRE ATLAS"
200version = "2026.08"
201[[rule.threat_mappings.threat]]
202framework = "MITRE ATLAS"
203[[rule.threat_mappings.threat.technique]]
204id = "AML.T0051"
205name = "LLM Prompt Injection"
206reference = "https://atlas.mitre.org/techniques/AML.T0051/"
207
208
209[rule.threat_mappings.threat.tactic]
210id = "AML.TA0005"
211name = "Execution"
212reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
213[[rule.threat_mappings.threat]]
214framework = "MITRE ATLAS"
215[[rule.threat_mappings.threat.technique]]
216id = "AML.T0054"
217name = "LLM Jailbreak"
218reference = "https://atlas.mitre.org/techniques/AML.T0054/"
219
220
221[rule.threat_mappings.threat.tactic]
222id = "AML.TA0007"
223name = "Defense Evasion"
224reference = "https://atlas.mitre.org/tactics/AML.TA0007/"