title: Injected Code — Remote-Key Ransomware File Encryption
id: ATR-2026-01896
rule_version: 1
status: experimental
description: Detects injected code that fetches an encryption key from a remote server (requests.get(.../get_key).content) and encrypts a victim file in place with Fernet/AES/ChaCha20/Blowfish — the defining shape of ransomware. The remote-key + in-place-encrypt pair is the invariant.
author: ATR Community
date: 2026/06/13
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM05:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0048 - External Harms
compliance:
  owasp_llm:
    - id: LLM05:2025
      context: Primary OWASP LLM mapping for this indirect-injection payload class.
      strength: primary
  owasp_agentic:
    - id: ASI01:2026
      context: Injected instructions inside untrusted data hijack the agent's goal toward an attacker-controlled output.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 robustness requires resistance to adversarial manipulation of AI output; this rule is a runtime detection control for the pattern.
      strength: primary
    - article: '9'
      context: Article 9 risk management catalogues this attack pattern with a runtime control.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: 'MEASURE 2.7 security/resilience evaluation: this rule surfaces the pattern for measurement.'
      strength: primary
    - subcategory: MG.2.3
      context: 'MANAGE 2.3 response to identified risks: runtime detection control.'
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 8.1 operational control includes monitoring processed data for embedded attack payloads.
      strength: primary
tags:
  category: model-abuse
  subcategory: ransomware
  scan_target: llm_io
  confidence: high
  corpus_source: bipia
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  method: pattern
  conditions:
    - field: user_input
      operator: regex
      value: (?i)requests\.get\([\"'][^\"'\n]{0,80}get_key[^\"'\n]{0,10}[\"']\)\.content
      description: 'BIPIA ransomware invariant #1'
  condition: any
  false_positives:
    - Security documentation, papers, or test suites that describe this attack technique without executing it.
    - Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.
response:
  actions:
    - alert
    - block_tool
  auto_response_threshold: critical
  message_template: '[ATR-2026-01896] Injected Code — Remote-Key Ransomware File Encryption detected (BIPIA ransomware).'