title: SQL Injection Destructive DDL Statement
id: ATR-2026-01601
rule_version: 1
status: experimental
description: |
  Detects SQL injection payloads that attempt destructive DDL operations:
  DROP TABLE, TRUNCATE TABLE, or unbounded DELETE FROM statements embedded
  in agent tool arguments. These attacks exploit agents that pass user input
  directly to database query tools, causing irreversible data destruction.
  The canonical form uses string-termination ( ' or " followed by ; ) to
  escape a parameterized context and inject a secondary statement.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM05:2025
  owasp_agentic:
    - ASI02:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
    - AML.T0101 - Data Destruction via AI Agent Tool Invocation
  mitre_attack:
    - T1485 - Data Destruction
compliance:
  owasp_llm:
    - id: LLM05:2025
      context: The patterns match a quote-and-semicolon break or a SQL comment marker followed by DROP TABLE, DATABASE, INDEX or VIEW, TRUNCATE or DELETE FROM, and DROP TABLE followed by a comment, in tool arguments or user input. LLM05:2025 lists LLM-generated SQL executed without parameterization as improper output handling; these statements delete data or schema in the database the tool queries.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Runtime detection of destructive SQL injection contributes to MEASURE 2.7 security and resilience evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 robustness requirements include resistance to adversarial inputs that cause data destruction.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must block agent SQL inputs containing destructive DDL (DROP / TRUNCATE / ALTER); such statements must never be reachable from untrusted tool arguments.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) requires risk treatment of known attack patterns; detecting destructive-DDL injection that causes permanent data loss and denial of service is such a treatment.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: sql-injection
  scan_target: tool_args
  confidence: high
  suppress_in_code_blocks: true
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)(?:'\s*;|"\s*;|--)\s*(?:DROP\s+(?:TABLE|DATABASE|INDEX|VIEW)|TRUNCATE\s+(?:TABLE\s+)?\w|DELETE\s+FROM\s+\w)
      description: 'SQL injection: quote-termination followed by destructive DDL'
    - field: tool_args
      operator: regex
      value: (?i)\bDROP\s+TABLE\s+\w+\s*(?:;\s*)?--
      description: DROP TABLE with comment suppressor
    - field: user_input
      operator: regex
      value: (?i)(?:'\s*;|"\s*;)\s*(?:DROP\s+TABLE|TRUNCATE|DELETE\s+FROM\s+\w)
      description: Destructive DDL injection in user input
  condition: any
  false_positives:
    - Database administrator agents with explicitly granted DDL permissions
    - Schema migration agents running authorized DROP/TRUNCATE operations
response:
  actions:
    - block_tool
    - alert
    - escalate
    - snapshot
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-01601] Destructive SQL injection detected. Tool argument
    contains DROP TABLE / TRUNCATE / DELETE injection pattern. Tool call blocked.
confidence: 92