title: Privilege Escalation and Admin Function Access
id: ATR-2026-00040
rule_version: 2
status: experimental
description: |
  Consolidated detection for privilege escalation attempts, covering both
  tool permission escalation and unauthorized admin function access. Detects
  when an agent requests or uses tools exceeding its permission scope,
  invokes administrative functions (user management, database admin, system
  config), attempts system-level operations (sudo, chmod, chown), container
  escape techniques (nsenter, chroot), or Kubernetes privilege escalation
  (kubectl exec). This rule enforces least-privilege boundaries across all
  agent tool interactions.
author: ATR Community
date: 2026/03/08
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
    - AML.T0040 - AI Model Inference API Access
  mitre_attack:
    - T1548 - Abuse Elevation Control Mechanism
    - T1611 - Escape to Host
  cve:
    - CVE-2026-0628
compliance:
  owasp_agentic:
    - id: ASI03:2026
      context: Privilege escalation via tool permission abuse or admin function invocation is the primary ASI03:2026 Identity and Privilege Abuse scenario — the agent acquires capabilities exceeding its authorized scope.
      strength: primary
  owasp_llm:
    - id: LLM06:2025
      context: An agent requesting tools with elevated permissions beyond its assigned role is the canonical LLM06:2025 Excessive Agency scenario, operationalized here via tool-name and argument pattern detection.
      strength: primary
  eu_ai_act:
    - article: '14'
      context: Article 14 requires that humans can oversee and intervene in AI system operation; privilege escalation techniques that bypass system-level controls directly undermine the human oversight mechanisms Article 14 mandates.
      strength: primary
    - article: '9'
      context: Privilege escalation is a documented high-severity risk in the AI system risk register; Article 9 requires monitoring controls to detect and respond to such scope violations.
      strength: secondary
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the privilege-escalation attempt (Privilege Escalation and Admin Function Access).
      strength: primary
  nist_ai_rmf:
    - function: Govern
      subcategory: GV.1.2
      context: GV.1.2 requires defined accountability roles and controls for AI system permissions; detection of privilege escalation enforces least-privilege boundaries established in the governance framework.
      strength: primary
    - function: Manage
      subcategory: MG.4.1
      context: Privilege escalation events require an incident response; this rule generates the alerts needed to initiate the MG.4.1 AI incident response process.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Privilege Escalation and Admin Function Access).
      strength: primary
    - subcategory: MG.2.3
      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the privilege-escalation attempt (Privilege Escalation and Admin Function Access) so the risk can be treated.
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Clause 6.2 AIMS security objectives include least-privilege enforcement for AI agent operations; this rule detects violations of those objectives at runtime.
      strength: primary
    - clause: '8.1'
      context: Clause 8.1 AI system operational control requires that agents do not exceed their authorized operational scope; privilege escalation detection enforces that operational boundary.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: tool-permission-escalation
  scan_target: mcp
  confidence: high
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)(?:--(?:privileged|cap-add|security-opt)|allowPrivilegeEscalation|"role"\s*:\s*"(?:admin|root|superuser|sudo)")
      description: Privileged flags or admin/root values in structured tool arguments (not natural language)
    - field: tool_args
      operator: regex
      value: (?i)(?:DROP\s+(?:TABLE|DATABASE|INDEX)\b(?!\s+IF\s+EXISTS)|ALTER\s+TABLE|TRUNCATE|DELETE\s+FROM\s+\w+\s*;|GRANT\s+ALL|REVOKE\s+ALL)
      description: Destructive or privileged SQL statements in arguments
    - field: tool_args
      operator: regex
      value: (?i)(?:nsenter\s+|chroot\s+|unshare\s+--mount|mount\s+--bind|docker\s+run\s+--privileged)
      description: Container escape techniques in tool arguments
    - field: tool_args
      operator: regex
      value: (?i)(?:kubectl\s+exec\b[^"']*(?:/bin/\w*sh|\bbash\b)|kubectl\s+(?:create|apply)\s+.*(?:clusterrole|rolebinding)|kubectl\s+auth\s+can-i)
      description: Kubernetes privilege escalation (RBAC-binding creation, auth probing, or exec that spawns an absolute-path/bash shell; routine interactive debug exec excluded)
    - field: tool_args
      operator: regex
      value: (?i)(?:chmod\s+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})(?:[^0-7]|$)|chmod\s+(?:-[-\w]+\s+)+(?:[0-7]?[0-7]{2}[2367]|[2467][0-7]{3})\s+(?:/(?:[\s"'*;]|$)|/(?:etc|usr|var|bin|sbin|boot|lib|opt|root|home|srv)\b|~|\$HOME)|chmod\s+[ug]\+s|chown\s+root|setcap\s+)
      description: Unix permission escalation commands (setuid, root ownership)
    - field: tool_args
      operator: regex
      value: (?i)(?:/etc/shadow|/etc/passwd|/etc/sudoers|/root/|/proc/\d+/mem|/dev/mem)
      description: Access to sensitive system files
  condition: any
  false_positives:
    - Agent with legitimate admin privileges executing authorized operations
    - CI/CD pipeline agents with legitimate deployment permissions
    - Database migration agents running authorized schema changes
    - Development or testing environment with intentionally broad tool access
response:
  actions:
    - escalate
    - alert
    - snapshot
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 254/5352 = 4.75% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_tool(interrupt), quarantine_session(terminate), reduce_permissions(degrade). Detection unchanged — recall cost is zero.'
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-040] CRITICAL: Privilege escalation or unauthorized admin
    function access detected. Agent {agent_id} attempted to use tool
    "{tool_name}" which exceeds its authorized scope. This rule no longer blocks
    the tool or quarantines the session; it alerts and escalates. The hook may
    still deny on severity — see docs/RESPONSE-ACTION-ELIGIBILITY.md. Session: {session_id}.
confidence: 85
wild_validated: 2026/04/08
wild_samples: 53577