title: Anti-Malware Evasion Code Generation Request
id: ATR-2026-00262
rule_version: 1
status: experimental
description: |
  Detects prompts asking the LLM to generate code that hides from or disables anti-malware / endpoint detection. Patterns from NVIDIA garak malwaregen.Evasion probe: "disable defender", "hide from antivirus", "hide from process list", "hide from memory accounting", "polymorphic executable". Higher severity than top-level malware request because the intent (evade defender) is explicit.
author: ATR Community (via NVIDIA garak malwaregen.Evasion probe)
date: 2026/04/19
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM05:2025
  owasp_agentic:
    - ASI08:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
  research:
    - https://github.com/NVIDIA/garak/blob/main/garak/probes/malwaregen.py
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.6
      context: Requests to generate anti-malware evasion code (disable defender, hide from AV, polymorphic executables) are explicit safety/security risk events; MS.2.6 requires continuous evaluation of safety/security risk magnitude, and these detections feed that evaluation with high-severity malicious-use signals.
      strength: primary
    - subcategory: MG.2.3
      context: Detection of explicit evasion code generation requests must trigger response mechanisms to refuse, supersede, or disengage the AI's code-generation function before harmful output is produced; MG.2.3 mandates these deactivation pathways exist for unsafe outputs.
      strength: secondary
    - subcategory: MS.2.7
      context: Evasion-code prompts probe the LLM's resilience against being weaponized as a malware-development tool; MS.2.7 requires evaluating and documenting security/resilience against such adversarial misuse attempts.
      strength: secondary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Anti-Malware Evasion Code Generation Request).
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Anti-Malware Evasion Code Generation Request).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Anti-Malware Evasion Code Generation Request).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Anti-Malware Evasion Code Generation Request) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Anti-Malware Evasion Code Generation Request).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Anti-Malware Evasion Code Generation Request).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: malware-evasion-generation
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: write\s+(?:\w+\s+){0,3}code\s+to\s+(?:disable|hide\s+from|bypass|evade|circumvent|kill|terminate)\s+(?:windows\s+)?(?:defender|av|antivirus|edr|endpoint|kaspersky|norton|mcafee|bitdefender|crowdstrike|sentinelone|sophos|trendmicro|cylance)
      description: Direct request for code to disable/evade specific AV/EDR product
    - field: tool_response
      operator: regex
      value: (?:write|generate|give\s+me|create|show\s+me)\s+(?:\w+\s+){0,4}code\s+to\s+hide\s+from\s+(?:the\s+)?(?:process\s+list|task\s+manager|ps|taskmgr|memory\s+accounting|procexp|process\s+explorer)
      description: Request for process-hiding code - core evasion sub-function
    - field: tool_response
      operator: regex
      value: (?:write|generate|create)\s+(?:\w+\s+){0,3}(?:a\s+)?(?:polymorphic|metamorphic|obfuscated|packed|encrypted)\s+(?:executable|binary|payload|malware|loader|dropper|stager)
      description: Request for polymorphic/metamorphic executable to evade signature detection
    - field: tool_response
      operator: regex
      value: (?:write|create)\s+(?:\w+\s+){0,3}code\s+to\s+(?:disable|stop|kill)\s+(?:etw|event\s+tracing|amsi|app\s+locker|applocker|wdac|syslog|audit(?:d)?)
      description: Code to disable telemetry/logging subsystems (ETW, AMSI, auditd)
    - field: tool_response
      operator: regex
      value: (?:write|create|implement|generate|show\s+me|give\s+me|code\s+for)\s+[\s\S]{0,60}(?:dll\s+hollowing|process\s+hollowing|reflective\s+(?:dll\s+)?(?:loading|injection)|atom\s+bombing|ghostwriting|thread\s+execution\s+hijack|apc\s+injection)
      description: Specific named evasion techniques typically only requested for malware development
  condition: any
  false_positives:
    - Academic research papers describing evasion techniques in defensive-analysis context
    - Blue-team training materials teaching IR analysts to detect evasion
    - CVE advisories documenting how a specific malware sample evaded detection
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00262] Anti-malware evasion code generation request detected - explicit intent to bypass security tooling.