title: Injected Code — Network Denial of Service (Connection Kill / Adapter Disable / Flood)
id: ATR-2026-01898
rule_version: 1
status: experimental
description: 'Detects injected code that disrupts connectivity: terminating every process owning a network connection, disabling network adapters via WMI, an unbounded request-flood loop, or a scapy SYN flood against a target.'
author: ATR Community
date: 2026/06/13
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: high
references:
  owasp_llm:
    - LLM05:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0048 - External Harms
compliance:
  owasp_llm:
    - id: LLM05:2025
      context: Primary OWASP LLM mapping for this indirect-injection payload class.
      strength: primary
  owasp_agentic:
    - id: ASI01:2026
      context: Injected instructions inside untrusted data hijack the agent's goal toward an attacker-controlled output.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 robustness requires resistance to adversarial manipulation of AI output; this rule is a runtime detection control for the pattern.
      strength: primary
    - article: '9'
      context: Article 9 risk management catalogues this attack pattern with a runtime control.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: 'MEASURE 2.7 security/resilience evaluation: this rule surfaces the pattern for measurement.'
      strength: primary
    - subcategory: MG.2.3
      context: 'MANAGE 2.3 response to identified risks: runtime detection control.'
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 8.1 operational control includes monitoring processed data for embedded attack payloads.
      strength: primary
tags:
  category: model-abuse
  subcategory: network-dos
  scan_target: llm_io
  confidence: high
  corpus_source: bipia
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  method: pattern
  conditions:
    - field: user_input
      operator: regex
      value: (?i)for\s+conn\s+in\s+psutil\.net_connections\(\)[\s\S]{0,80}\.terminate\(\)
      description: 'BIPIA network-dos invariant #1'
    - field: user_input
      operator: regex
      value: (?i)Win32_NetworkAdapterConfiguration\([\s\S]{0,60}\.Disable\(\)
      description: 'BIPIA network-dos invariant #2'
    - field: user_input
      operator: regex
      value: (?i)while\s+True\s*:[\s\S]{0,80}requests\.get\([^\n]{0,40}\btimeout\s*=\s*1\b
      description: 'BIPIA network-dos invariant #3'
    - field: user_input
      operator: regex
      value: (?i)while\s+True\s*:[\s\S]{0,80}TCP\(dport=\d+,\s*flags=[\"']S[\"']
      description: 'BIPIA network-dos invariant #4'
  condition: any
  false_positives:
    - Security documentation, papers, or test suites that describe this attack technique without executing it.
    - Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.
response:
  actions:
    - alert
    - block_tool
  auto_response_threshold: high
  message_template: '[ATR-2026-01898] Injected Code — Network Denial of Service (Connection Kill / Adapter Disable / Flood) detected (BIPIA network-dos).'