title: Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)
id: ATR-2026-00441
rule_version: 1
status: experimental
description: |
  Detects exploitation of CVE-2026-25592 (Critical), arbitrary file write via SessionsPythonPlugin in Microsoft Semantic Kernel. The vulnerable sink accepts unvalidated file paths via DownloadFileAsync; combined with the plugin's ExecuteCode capability, attacker writes payloads to host Startup / cron / systemd-user paths, achieving sandbox escape and persistence. The full kill chain is ExecuteCode -> generate payload -> DownloadFileAsync -> write to autostart directory -> reboot triggers RCE outside the sandbox. This rule detects the over-privileged tool descriptor patterns and the autostart-target file-write payloads that reach the SessionsPythonPlugin sink. CWE-22 (path traversal), CWE-73 (external control of file name). Patches in semantic-kernel Python >= 1.39.4 and .NET >= 1.71.0; this rule detects exploit attempts against unpatched deployments and provides defence-in-depth post-patch by catching the autostart-write pattern regardless of upstream patch state.
author: ATR Community
date: 2026/05/11
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM06:2025
    - LLM05:2025
  owasp_agentic:
    - ASI05:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
    - AML.T0105 - Escape to Host
  mitre_attack:
    - T1547 - Boot or Logon Autostart Execution
    - T1547.001 - Registry Run Keys / Startup Folder
    - T1053 - Scheduled Task/Job
    - T1611 - Escape to Host
  cve:
    - CVE-2026-25592
metadata_provenance:
  mitre_atlas: human-reviewed
  mitre_attack: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  cve: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2026-25592 in Semantic Kernel SessionsPythonPlugin lets an agent write to host autostart paths via DownloadFileAsync, achieving persistence outside the sandbox; Article 15 cybersecurity requirements mandate that AI system sandboxes prevent unauthorised file writes to system-level persistence locations.
      strength: primary
    - article: '14'
      context: Persistence via host Startup folder explicitly defeats Article 14 human oversight — by reboot the malicious code runs without any agent loop or human interaction. Detection of autostart-write attempts is a primary control.
      strength: primary
    - article: '9'
      context: Sandbox-escape via plugin file-write is a critical risk class that Article 9 risk management must enumerate when deploying any agent with both code-execution and file-write capabilities.
      strength: primary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Persistence payloads written to autostart directories must be tracked as a primary post-exploit pattern; the boundary between agent-controlled tmpfs and host autostart paths must be enforced and monitored.
      strength: primary
    - subcategory: MG.4.1
      context: An autostart-write event from an agent plugin requires immediate incident response; this rule generates the alert needed to initiate the MG.4.1 AI incident response process before the next host reboot triggers the payload.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment plans under MG.2.3 must require that plugins exposing both file-write and code-execution capabilities are flagged for separation of duties and runtime monitoring.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)).
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Clause 8.1 operational controls require that agent plugins do not exceed their authorised operational scope; writing to OS-level autostart paths is unambiguously out-of-scope for any documented AI plugin.
      strength: primary
    - clause: '6.2'
      context: Clause 6.2 AIMS security objectives include least-privilege enforcement; detection of over-privileged tool descriptors (combining ExecuteCode + arbitrary file-write) operationalises that objective.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: sandbox-escape-persistence
  scan_target: both
  confidence: high
agent_source:
  type: tool_call
  framework:
    - semantic-kernel
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Legitimate developer documentation referencing Windows Startup folder for non-malicious use cases (installer behaviour, productivity software).
    - Detection rule corpora (this repo, SigmaHQ, MISP) documenting CVE-2026-25592 patterns for defensive purposes.
    - Patched SessionsPythonPlugin deployments that perform path-canonicalisation and reject autostart targets before write.
    - Benign discussion of process / app / shell `startup` in English prose without a path or file-write context.
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)\b(?:destination|dest|target|output|out_path|out_file|file|path|to|filename|filepath|file_path)["\x27]?\s*[:=]\s*["\x27]?[^"\x27,)]{0,40}(?:AppData[\\/]+Roaming[\\/]+Microsoft[\\/]+Windows[\\/]+Start Menu[\\/]+Programs[\\/]+Startup|[\\/]+Start Menu[\\/]+Programs[\\/]+Startup[\\/]+|[\\/]+\.config[\\/]+autostart[\\/]+|[\\/]+\.config[\\/]+systemd[\\/]+user[\\/]+|/etc/cron\.(?:hourly|daily|weekly|monthly|d)/|/etc/init\.d/|/etc/systemd/system/|/Library/LaunchAgents/|/Library/LaunchDaemons/|~/Library/LaunchAgents/)
      description: Tool argument whose path / destination / target value is an OS-level autostart / persistence path (Windows Start Menu Startup, XDG autostart, systemd-user, cron, macOS LaunchAgents/Daemons). Allows optional quote between keyword and separator (JSON form `"destination":"path"`). Requires a write-context keyword before the path so admin-doc references to `/etc/systemd/system/` without a write-arg context do not match.
    - field: tool_name
      operator: regex
      value: (?i)\b(?:SessionsPythonPlugin|Microsoft\.SemanticKernel\.Plugins\.[A-Za-z]*Sessions|kernel_function_download_file|sessions_python)\b
      description: Tool descriptor referencing Semantic Kernel SessionsPythonPlugin or its fully-qualified variants — narrowed to SK-specific identifiers.
    - field: tool_description
      operator: regex
      value: (?i)(?:download|write|save)[^.]{0,120}\b(?:to\s+)?(?:arbitrary\s+(?:path|location)|any\s+(?:directory|location|path)|user[-_]?(?:supplied|specified|provided)\s+path|unvalidated\s+path)\b
      description: Tool descriptor that explicitly advertises file-write to arbitrary / user-supplied / unvalidated paths — over-privileged descriptor pattern that enables CVE-2026-25592.
    - field: content
      operator: regex
      value: (?i)\b(?:DownloadFileAsync|download_file|fs\.writeFile|writeFile(?:Sync)?)\s*\(\s*["\x27]?[^)]{0,200}(?:[\\/]+Start Menu[\\/]+Programs[\\/]+Startup[\\/]+|AppData[\\/]+Roaming[\\/]+Microsoft[\\/]+Windows|[\\/]+\.config[\\/]+autostart[\\/]+|/etc/cron\.(?:hourly|daily|weekly|monthly|d)/|/Library/LaunchAgents/|/etc/systemd/system/)
      description: Direct file-write function call whose destination argument is an autostart path — explicit exploit signature with two anchors (call site + path).
    - field: content
      operator: regex
      value: (?i)(?:\breg\s+add\s+(?:HKCU|HKLM|HKEY_)|HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run|HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run|\bregedit(?:\.exe)?\s+/s\s+)
      description: Windows registry Run-key persistence (`reg add HKCU\..\Run`, full Run-key path, or `regedit /s`) — alternative persistence vector. Word-boundary anchored to avoid substring matches in normal English (register, regex, aggregated).
response:
  actions:
    - block_tool
    - alert
    - escalate
    - snapshot
  notify:
    - security_team
remediation: |
  Upgrade Python semantic-kernel to >= 1.39.4 or .NET semantic-kernel to >= 1.71.0. Restrict SessionsPythonPlugin file-write to a fixed jail directory; canonicalise paths and reject any target outside the jail. Never grant the same plugin both ExecuteCode and unrestricted file-write in the same security boundary. Monitor for writes targeting OS-level autostart paths (Startup folder, ~/.config/autostart, /etc/cron.*, systemd-user units, LaunchAgents) regardless of source.