title: Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook
id: ATR-2026-01609
rule_version: 1
status: experimental
description: |
  Detects shell injection payloads that chain legitimate-looking commands
  with data exfiltration via curl, wget, or netcat (nc) to an external
  webhook. The attack pattern is: run a benign command (git status, npm test,
  tail logs) then pipe sensitive data (environment variables, .env files,
  API keys) to an attacker-controlled server using curl -X POST, wget -qO-,
  or nc. These payloads exploit agents that execute shell commands on behalf
  of users without scrutinizing the full command pipeline.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
  mitre_attack:
    - T1048 - Exfiltration Over Alternative Protocol
compliance:
  owasp_llm:
    - id: LLM06:2025
      context: The agent executes shell commands beyond its intended scope, exfiltrating sensitive environment data.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detection of shell exfiltration injection supports MEASURE 2.7 security evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Shell exfiltration via webhook is adversarial manipulation of agent tool execution.
      strength: primary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment under Clause 6.2 must mandate input sanitization that strips or rejects shell metacharacters and outbound network commands (curl / wget / netcat) from agent tool arguments before they reach any process-execution layer.
      strength: primary
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must enforce argument sanitization at the tool boundary so injected webhook-exfiltration commands cannot read and transmit environment secrets outside authorised operations.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: shell-injection
  scan_target: tool_args
  confidence: high
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)\b(?:curl|wget|nc)\b[^\n]{0,60}?[\w.\-]*(?:\.evil\.|webhook\.evil|exfil[\w.\-]*\.|attacker\.|malicious\.)[\w.\-/]*
      description: curl/wget/nc to a clearly attacker-named exfil host (.evil./exfil./attacker./malicious.)
    - field: user_input
      operator: regex
      value: (?i)\b(?:curl|wget|nc)\b[^\n]{0,60}?[\w.\-]*(?:\.evil\.|webhook\.evil|exfil[\w.\-]*\.|attacker\.|malicious\.)[\w.\-/]*
      description: curl/wget/nc to a clearly attacker-named exfil host (user-supplied shell)
    - field: tool_args
      operator: regex
      value: (?i)\b(?:env|printenv|\bcat\s+\.env|API_KEY|SECRET)\b[^\n]{0,80}?\|[^\n]{0,80}?\b(?:curl|wget|nc)\b
      description: Environment/secret source piped into a network egress tool (exfil pipeline)
    - field: user_input
      operator: regex
      value: (?i)\b(?:env|printenv|\bcat\s+\.env|API_KEY|SECRET)\b[^\n]{0,80}?\|[^\n]{0,80}?\b(?:curl|wget|nc)\b
      description: Environment/secret source piped into a network egress tool (user-supplied shell)
    - field: tool_args
      operator: regex
      value: (?i)\b(?:env|printenv|\bcat\s+\.env|\.env|pwd)\b[^\n]{0,60}?\|\s*(?:base64|xxd)\b[^\n]{0,40}?\|\s*(?:curl|wget|nc)\b
      description: Secret/env piped through base64/xxd then to curl/wget/nc (encode-then-exfil)
    - field: user_input
      operator: regex
      value: (?i)\b(?:env|printenv|\bcat\s+\.env|\.env|pwd)\b[^\n]{0,60}?\|\s*(?:base64|xxd)\b[^\n]{0,40}?\|\s*(?:curl|wget|nc)\b
      description: Secret/env piped through base64/xxd then to curl/wget/nc (user-supplied shell)
  condition: any
  false_positives:
    - CI/CD agents posting legitimate build status to authorized webhooks
    - Monitoring agents sending metrics to approved telemetry endpoints
response:
  actions:
    - block_tool
    - alert
    - escalate
    - snapshot
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-01609] Shell exfiltration injection detected. Command
    pipeline posts sensitive data to external endpoint. Tool call blocked.
confidence: 88