title: Hardcoded Suspicious IP Address in Skill Content
id: ATR-2026-00225
rule_version: 2
status: experimental
description: |
  Detects hardcoded IP addresses in skill content that may represent command and control  (C2) servers, particularly when associated with suspicious network ranges or known  malware infrastructure. The analyzed skill "sakaen736jih/youtube-watcher-p" contains  reference to IP 91.92.242.30 identified as a known malware C2 server.
author: ATR Threat Cloud Crystallization
date: 2026/04/15
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM09:2025
  owasp_agentic:
    - ASI04:2026
  mitre_atlas:
    - AML.T0048
compliance:
  nist_ai_rmf:
    - subcategory: GV.6.1
      context: Hardcoded references to known malware C2 IP addresses inside third-party skill content directly evidence supplier/third-party AI risks; GV.6.1 requires policies that screen externally sourced skill artifacts for malicious infrastructure indicators before integration.
      strength: primary
    - subcategory: MG.3.1
      context: Detection of embedded C2 IPs in a third-party skill triggers the third-party risk management activities required by MG.3.1, allowing the supplier-supplied component to be quarantined or removed before execution.
      strength: secondary
    - subcategory: MS.2.7
      context: Identifying hardcoded malicious infrastructure in skill content contributes to continuous security/resilience evaluation under MS.2.7 by surfacing supply-chain compromise indicators that degrade system security posture.
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Hardcoded Suspicious IP Address in Skill Content).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Hardcoded Suspicious IP Address in Skill Content).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Hardcoded Suspicious IP Address in Skill Content) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Hardcoded Suspicious IP Address in Skill Content).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Hardcoded Suspicious IP Address in Skill Content).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: c2-communication
  scan_target: skill
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (C2\s+server|command\s+control|malware\s+actor)\s+[^\n]*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
      description: References to C2 server or malware actor with IP address
    - field: content
      operator: regex
      value: (known|identified|detected)\s+(malware|threat|actor|server)[^\n]*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
      description: Explicit identification of malicious infrastructure with IP
    - field: content
      operator: regex
      value: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[^\n\\]{0,120}?\b(?:C2|backdoor|malware|command[\s-]{0,3}(?:(?:and|&)[\s-]{0,3})?control)\b
      description: 'IP address followed, on the same line and within 120 characters, by a malicious infrastructure term as a whole word: C2, backdoor, malware, or command (and/&) control. "command" and "control" alone matched every IP line that later said startup-commands.md or management controller, and C2 matched inside EC2. A backslash ends the line too, because a JSON-encoded event carries a newline as the two characters \n, where [^\n] alone ran to the end of the document'
    - field: content
      operator: regex
      value: (91\.92\.24[0-9]\.|185\.159\.15[0-9]\.|194\.87\.9[0-9]\.)[0-9]{1,3}
      description: Known malicious IP ranges commonly used for C2
    - field: content
      operator: regex
      value: finding_[0-9]+:\s*(known|identified)\s+(malware|threat|C2|command)
      description: Structured threat intelligence findings format
  condition: any
  false_positives:
    - Security research documentation describing C2 patterns
    - Threat intelligence feeds in legitimate security tools
    - Network monitoring tools documenting suspicious activity
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00225] Skill contains reference to known malicious IP infrastructure