title: Fake Documentation Pretext Data Exfiltration via Email
id: ATR-2026-02850
rule_version: 1
status: experimental
description: |
  Detects attempts to exfiltrate captured or sensitive information by invoking a false "documentation", "records", or compliance pretext that instructs forwarding, transmitting, consolidating, or logging captured data to an external email address. This pattern recurs in phishing and social-engineering style injected content in both English and French, where attackers frame data transmission as routine internal record-keeping ("for our documentation", "for our records", "documentation and guidelines", "internal documentation", "pour notre documentation") immediately followed by a transmission verb ("forward", "transmit", "transmettre", "send", "consolidate", "log", "maintain") and an email address. Detection requires the pretext phrase, the transmission verb, and an email address within a bounded context window to minimize false positives on legitimate documentation references that do not instruct sending data anywhere.
author: ATR Community
date: 2026/10/06
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM02:2025
  owasp_agentic:
    - ASI09:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0057 - LLM Data Leakage
  mitre_attack:
    - T1566 - Phishing
    - T1048 - Exfiltration Over Alternative Protocol
compliance:
  eu_ai_act:
    - article: '15'
      context: High-risk AI systems must be resilient against adversarial attempts to manipulate the system into exfiltrating data; detecting fake-documentation forwarding pretexts provides detection evidence supporting Article 15 requirements for robustness against input-based manipulation.
      strength: primary
    - article: '9'
      context: Fake-documentation exfiltration pretexts constitute a documented risk class in the AI system risk register; Article 9 requires that monitoring controls are deployed to detect these attempts at runtime.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Fake-documentation forwarding requests are a class of adversarial social-engineering input against AI systems; MP.5.1 requires that such adversarial input risks are identified and tracked so that runtime detection controls like this rule can be deployed.
      strength: primary
    - subcategory: MG.3.2
      context: Detected fake-documentation exfiltration attempts require monitoring of third-party risks introduced through injected content that directs the system to transmit data externally, as required by MG.3.2.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Clause 8.1 operational controls ensure AI systems execute correctly and consistently; runtime detection of fake-documentation exfiltration pretexts enforces that data-handling constraints remain active despite adversarial instructions to forward captured information externally.
      strength: primary
    - clause: '8.3'
      context: Clause 8.3 requires AI systems to respond appropriately to issues throughout their lifecycle; this rule provides the detection event needed to trigger containment of an in-progress data exfiltration attempt.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: fake-documentation-forward-request
  scan_target: mcp
  confidence: high
agent_source:
  type: llm_io
  framework:
    - openai
    - anthropic
    - langchain
    - llamaindex
    - autogen
    - crewai
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)\b(?:for\s+our\s+(?:documentation|records)|pour\s+notre\s+documentation|documentation\s+and\s+guidelines|internal\s+documentation)\b[\s\S]{0,100}\b(?:forward(?:ed|ing)?|transmit|transmettre|send(?:ing)?|consolidat\w*|logged?|maintained)\b[\s\S]{0,100}@[\w.-]{1,50}
      description: Fake documentation/records pretext instructing forwarding, transmission, or logging of captured information to an email address
  condition: any
  false_positives:
    - Legitimate references to internal documentation or recordkeeping that do not instruct sending data anywhere
    - Compliance or HR documentation discussions that mention maintenance of records without an associated email transmission instruction
    - Project documentation notes that happen to be near an unrelated email address in the same message
response:
  actions:
    - alert
    - snapshot
    - escalate
  auto_response_threshold: high
  message_template: '[ATR-2026-02850] Fake Documentation Pretext Data Exfiltration via Email detected.'
confidence: 90