title: Injected Code — Host / Hardware Inventory Exfiltration
id: ATR-2026-01893
rule_version: 1
status: experimental
description: Detects injected code that enumerates the host (installed packages, virtual memory, USB devices, disk partitions, network interfaces, sound devices) and ships the inventory to a remote server via HTTP POST or MQTT. Host fingerprinting is reconnaissance preceding targeted compromise.
author: ATR Community
date: 2026/06/13
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: high
references:
  owasp_llm:
    - LLM02:2025
    - LLM05:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0057 - LLM Data Leakage
compliance:
  owasp_llm:
    - id: LLM02:2025
      context: Primary OWASP LLM mapping for this indirect-injection payload class.
      strength: primary
  owasp_agentic:
    - id: ASI01:2026
      context: Injected instructions inside untrusted data hijack the agent's goal toward an attacker-controlled output.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 robustness requires resistance to adversarial manipulation of AI output; this rule is a runtime detection control for the pattern.
      strength: primary
    - article: '9'
      context: Article 9 risk management catalogues this attack pattern with a runtime control.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: 'MEASURE 2.7 security/resilience evaluation: this rule surfaces the pattern for measurement.'
      strength: primary
    - subcategory: MG.2.3
      context: 'MANAGE 2.3 response to identified risks: runtime detection control.'
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 8.1 operational control includes monitoring processed data for embedded attack payloads.
      strength: primary
tags:
  category: context-exfiltration
  subcategory: system-recon-exfiltration
  scan_target: llm_io
  confidence: high
  corpus_source: bipia
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  method: pattern
  conditions:
    - field: user_input
      operator: regex
      value: (?i)pkg_resources\.working_set[\s\S]{0,120}requests\.post\(
      description: 'BIPIA system-recon-exfiltration invariant #1'
    - field: user_input
      operator: regex
      value: (?i)(?:requests\.post\(|publish\.single\()[\s\S]{0,140}psutil\.virtual_memory\(\)
      description: 'BIPIA system-recon-exfiltration invariant #2'
    - field: user_input
      operator: regex
      value: (?i)(?:usb\.core\.find|psutil\.disk_partitions|psutil\.net_if_addrs|sd\.query_devices)\([\s\S]{0,160}requests\.post\(
      description: 'BIPIA system-recon-exfiltration invariant #3'
  condition: any
  false_positives:
    - Security documentation, papers, or test suites that describe this attack technique without executing it.
    - Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.
response:
  actions:
    - alert
    - block_tool
  auto_response_threshold: high
  message_template: '[ATR-2026-01893] Injected Code — Host / Hardware Inventory Exfiltration detected (BIPIA system-recon-exfiltration).'