title: Base64 Encoded Remote Code Execution via Raw IP
id: ATR-2026-00220
rule_version: 1
status: experimental
description: |
  Detects Base64-encoded payloads that decode to curl commands fetching executable content from raw IP addresses, then piping to bash for execution. This pattern is characteristic of malware droppers and supply chain attacks that disguise malicious installation commands.
author: ATR Threat Cloud Crystallization
date: 2026/04/10
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM07:2025
  owasp_agentic:
    - ASI04:2026
  mitre_atlas:
    - AML.T0048
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Base64-encoded curl-to-bash payloads fetching executables from raw IP addresses are obfuscated remote code execution attempts targeting agent skill integrity; MS.2.7 requires continuous evaluation of system security and resilience against such malware dropper patterns.
      strength: primary
    - subcategory: MG.3.2
      context: Fetching and executing arbitrary code from untrusted IP endpoints constitutes a supply chain compromise vector for any pre-trained models or agent skills consumed; MG.3.2 requires monitoring of third-party code and model artifacts to prevent dropper-based tampering.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of Base64-obfuscated shell execution chains must trigger immediate containment to prevent the dropper from completing installation; MG.2.3 mandates mechanisms to disengage or deactivate the agent before malicious code runs.
      strength: secondary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Base64 Encoded Remote Code Execution via Raw IP).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Base64 Encoded Remote Code Execution via Raw IP).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Base64 Encoded Remote Code Execution via Raw IP) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Base64 Encoded Remote Code Execution via Raw IP).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Base64 Encoded Remote Code Execution via Raw IP).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: malware-dropper
  scan_target: both
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?:^|[^a-zA-Z0-9+/])[a-zA-Z0-9+/]{40}[^\n]{0,400}base64\s+-[dD]
      description: Base64 encoded payload with decode instruction
    - field: content
      operator: regex
      value: (curl|wget)\s+[^\n]*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[^|]*\|\s*(bash|sh)
      description: Curl/wget from raw IP piped to shell execution
    - field: content
      operator: regex
      value: echo[^\n]{0,200}[^a-zA-Z0-9+/][a-zA-Z0-9+/]{30}[^\n]{0,200}\|\s*base64
      description: Echo Base64 payload piped to decoder
    - field: content
      operator: regex
      value: \$\(curl\s+(?:[^)'"]*?(?:https?|ftp):\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:-\S+\s+)*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[^)]*\)
      description: Command substitution with curl fetching from a raw IP (IP must be the curl URL/target, not inside a quoted data payload)
    - field: content
      operator: regex
      value: (openclaw|setup-service|download\..*\.com).*91\.92\.24[23]\.\d{1,3}
      description: Suspicious tool names with specific malicious IP ranges
  condition: any
  false_positives:
    - Legitimate CI/CD scripts that use named domains for downloads
    - Official package managers downloading from CDNs
    - Documentation showing Base64 examples without execution context
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00220] Malware dropper detected: Base64-encoded remote code execution from raw IP