title: Shell Evasion Subshell and Command Substitution Injection
id: ATR-2026-01610
rule_version: 1
status: experimental
description: |
  Detects shell command injection using subshell expansion techniques that
  evade simple keyword filters: backtick substitution (`command`),
  dollar-paren substitution ($(command)), Perl/Ruby interpolated execution
  (@{[system "cmd"]}), and PowerShell inline execution. These evasion forms
  are commonly embedded in user-supplied strings to exploit agents that
  pass input to shell-executing tools without stripping shell metacharacters.
  The BLNS (Big List of Naughty Strings) includes many of these patterns
  as documented injection vectors.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: experimental
severity: high
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
compliance:
  owasp_llm:
    - id: LLM06:2025
      context: Subshell injection allows arbitrary command execution beyond the agent's authorized scope.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detection of subshell injection evasion supports MEASURE 2.7 security evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 robustness and cybersecurity requirements mandate detection of adversarial inputs; subshell and command-substitution syntax ($(...), backticks) that smuggles arbitrary command execution is such an input.
      strength: primary
    - article: '14'
      context: Article 14 human oversight requires that privilege-affecting actions remain observable and controllable; subshell injection that executes commands outside the agent's authorised scope undermines that oversight, so detection evidence is required.
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment under Clause 6.2 must mandate input sanitization that rejects command-substitution constructs ($(...), backticks, nested subshells) in agent tool arguments before any process-execution layer.
      strength: primary
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must enforce metacharacter sanitization at the tool boundary so subshell-based evasion cannot redirect agent actions outside authorised and observable operations.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: shell-injection
  scan_target: user_input
  confidence: high
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: |-
        \$\((?:touch|rm|ls|cat|curl|wget|nc|bash|sh|cmd|powershell|python|ruby|perl|node)\b[^)
        ]{0,80}\)
      description: Dollar-paren subshell in structured tool arguments (no newlines)
    - field: tool_args
      operator: regex
      value: |-
        `(?:touch|rm|ls|cat|curl|wget|nc|bash|sh|python|ruby|perl)\b[^
        `]{0,80}`
      description: Backtick injection in structured tool arguments (no newlines = not markdown code block)
    - field: user_input
      operator: regex
      value: '@\{\[(?:system|exec|IO\.popen)\s+["''][^"''\n]{2,}["'']\]\}'
      description: Perl/Ruby @{[system ...]} interpolated execution
  condition: any
  false_positives:
    - Shell scripting documentation or training content in knowledge bases
    - Code review agents analyzing shell scripts for legitimate CI purposes
response:
  actions:
    - alert
    - snapshot
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 1180/5352 = 22.05% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
  auto_response_threshold: high
  message_template: |
    [ATR-2026-01610] Shell subshell/backtick injection detected. Command
    substitution metacharacters found in input. This rule no longer blocks the
    tool; it alerts. The hook may still deny on severity — see
    docs/RESPONSE-ACTION-ELIGIBILITY.md.
confidence: 86