title: Shell Injection Data Exfiltration — Piped Command Exfiltration via Bash
id: ATR-2026-00863
rule_version: 1
status: experimental
description: |
  Detects shell command injection payloads that combine a seemingly legitimate shell operation with a piped or chained data exfiltration command. The attack embeds a benign-sounding task (ping, git status, grep for audit) with a follow-on command that reads sensitive files (.env, credentials, passwords) and POSTs or transmits the data to an attacker-controlled endpoint via curl, wget, nc, or Python urllib. Derived from the exfil-shell-injection corpus. This extends rule ATR-2026-00201 (credential pipe exfiltration) to cover shell script compound command patterns beyond environment variable pipes.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM01:2025
    - LLM06:2025
  owasp_agentic:
    - ASI03:2026
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0057 - LLM Data Leakage
  mitre_attack:
    - 'T1059.004 - Command and Scripting Interpreter: Unix Shell'
    - T1041 - Exfiltration Over C2 Channel
    - T1552.001 - Credentials In Files
  research:
    - https://arxiv.org/abs/2310.03684
compliance:
  eu_ai_act:
    - article: '15'
      context: Shell injection combining legitimate tasks with credential-read-and-exfil commands exploits AI agents with shell tool access; Article 15 requires robustness against adversarial shell commands targeting sensitive files.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Shell injection data exfiltration via piped commands is a compound attack pattern; MS.2.7 security documentation must cover this adversarial shell-tool exploitation vector.
      strength: primary
    - subcategory: MG.2.3
      context: Shell exfil commands execute rapidly; MG.2.3 containment must block bash tool execution when compound exfil patterns are detected in shell input.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Agents with bash/shell tool access must have operational controls detecting compound shell commands that combine task-covering operations with credential file reads and network transmission.
      strength: primary
tags:
  category: context-exfiltration
  subcategory: shell-injection-exfil
  scan_target: mcp
  confidence: high
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:(?:&&|\|\|?|;)\s*(?:then\s+)?|;\s*(?:do\s+)?)\s*(?:curl|wget|nc|netcat|python3?\s+-c|node\s+-e)[^\n]{0,150}(?:http[s]?://)[^\s]{5,150}(?:\$\(|`)[^\n]{0,80}(?:\bcat\s+[.~]?/?(?:\.env|\.bash_history|\w+(?:password|secret|cred|key)[^\s]*)|\.env)
      description: 'Shell compound: chained curl/wget/nc after semicolon/AND with $( cat .env ) subshell exfil'
    - field: content
      operator: regex
      value: (?i)(?:&&|\|\|?|;)\s*(?:then\s+)?(?:curl|wget)\s+[^\n]{0,50}(?:http[s]?://)[^\s]{5,100}\$\([^\)]{0,80}\|\s*base64\)
      description: base64-subshell piped into curl/wget HTTP exfil endpoint
    - field: content
      operator: regex
      value: (?i)grep\s+.{0,40}(?:password|credential|secret|token|api[_-]?key).{0,40}(?:&&|\||\|\|)\s*(?:echo|curl|wget|nc)[^\n]{0,150}(?:base64|http[s]?://)[^\n]{0,100}(?:nc|netcat|curl|wget)\s+[^\s]{3,80}\s+\d{2,5}
      description: grep credential + pipe to nc/curl with base64 payload (audit-framing attack)
    - field: content
      operator: regex
      value: (?i)python3?\s+-c[^\n]{0,100}(?:http[s]?://)[^\s]{5,100}[^\n]{0,100}open\s*\(['"][^'"]{0,30}(?:\.env|password|cred|secret|key)
      description: python3 -c with HTTP URL + open('.env') data exfil
  condition: any
  false_positives:
    - Security audit scripts that grep for credentials to detect exposure in repos (without network transmission)
    - Legitimate CI/CD pipelines posting build status to webhook endpoints
    - Development documentation explaining shell scripting patterns
response:
  actions:
    - alert
    - block_tool
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0/5352 benign FP, but maturity is "test" — only stable is rated for irreversible actions; ceiling = degrade. Removed quarantine_session(terminate). Detection unchanged — recall cost is zero.'
  auto_response_threshold: high
  message_template: |
    [ATR-2026-00863] Shell injection data exfiltration detected — compound shell command combines a cover task with credential file reads and HTTP transmission to an attacker-controlled endpoint.