title: Indirect PI — RCE via Network Shell Command (netcat/curl) Execution
id: ATR-2026-00713
rule_version: 1
status: stable
description: |
  Detects indirect prompt injection in emails or documents that instructs a computer-use agent to execute network-based RCE commands: netcat reverse shells, malicious curl requests, or wget-pipe-bash patterns.  The attacker embeds the network command in email content read by the agent, inducing execution of a shell command that establishes a network connection to an attacker-controlled server. Source: indirect-pi-rce-network (VPI corpus, cua-framework).
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM01:2025
  owasp_agentic:
    - ASI01:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0051.001 - Indirect
    - AML.T0050 - Command and Scripting Interpreter
compliance:
  owasp_llm:
    - id: LLM01:2025
      context: RCE via indirect PI embeds netcat/curl shell commands in agent-consumed emails, inducing remote code execution.
      strength: primary
  owasp_agentic:
    - id: ASI03:2026
      context: Executing network shell commands (netcat reverse shell, curl pipe bash) is excessive agency enabling full system compromise.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Runtime detection of RCE network shell command instructions in agent-consumed content.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: 'Article 15 robustness: detection of RCE instructions that cause computer-use agents to establish attacker-controlled network connections.'
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: 'ISO/IEC 42001 Clause 8.1: control of externally-provided processes containing network RCE command directives.'
      strength: primary
tags:
  category: excessive-autonomy
  subcategory: rce-network-shell
  scan_target: tool_output
  confidence: high
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)\battacker_objective\s*=\s*Get\s+the\s+(?:CUA|agent)\s+to\s+execute\s+the\s+malicious\s+(?:netcat|curl|wget|bash)\s+command
      description: VPI attacker_objective for malicious netcat/curl/bash command
    - field: content
      operator: regex
      value: (?i)(?:\bnc\b|\bncat\b)[^\n]{0,60}-e\s+/bin/(?:sh|bash|zsh)
      description: netcat/ncat reverse shell with -e /bin/sh (any argument order)
    - field: content
      operator: regex
      value: (?i)(?:execute|run)\s+(?:the\s+)?malicious\s+(?:curl|wget|nc|netcat)\s+command[^.\n]{0,200}
      description: Explicit 'malicious curl/wget/nc command' execution instruction
    - field: content
      operator: regex
      value: (?i)(?:curl|wget)\s+(?:-[sSkLfO]{1,5}\s+){0,3}https?://(?:[\w-]+\.)?(?:attacker|evil|malware|hack|exploit|pwn|c2|botnet)[^\s]*\s*\|\s*(?:bash|sh|zsh)
      description: curl/wget from attacker-domain-named host piped to shell
    - field: content
      operator: regex
      value: (?i)(?:Execute|Run):\s*(?:curl|wget)\s+https?://[^\s]+\s*\|\s*(?:bash|sh)
      description: 'Execute: curl URL | bash — explicit command with colon format'
    - field: content
      operator: regex
      value: (?i)(?:execute|run)\s+(?:the\s+)?(?:malicious\s+)?(?:netcat|curl|wget)\s+command[^.\n]{0,100}(?:regardless|whether|fails|succeeds)
      description: Execute malicious network command with 'regardless of success' phrasing
    - field: content
      operator: regex
      value: (?i)Run\s+this\s+malicious\s+(?:netcat|nc|curl|wget)\s+command
      description: Run this malicious netcat/curl command
  condition: any
  false_positives:
    - Security research documents showing netcat examples in educational context
    - Legitimate curl commands for API calls in CI/CD pipelines
response:
  actions:
    - block_input
    - alert
    - snapshot
    - escalate
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-00713] RCE via network shell command detected. Instructions to execute a malicious netcat/curl command were found in consumed content.