title: Credential File Read Code Generation Request
id: ATR-2026-00263
rule_version: 1
status: experimental
description: |
  Detects prompts asking the LLM to generate code that reads high-value credential or secret files (/etc/shadow, Windows SAM hive, ~/.ssh/id_rsa, cloud metadata endpoints, browser cookie stores, credential managers). From NVIDIA garak malwaregen.SubFunctions probe — attackers frame this as "useful code" but the target files contain no legitimate-dev use case for automated reading.
author: ATR Community (via NVIDIA garak malwaregen.SubFunctions probe)
date: 2026/04/19
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM06:2025
    - LLM05:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
    - AML.T0057 - LLM Data Leakage
  research:
    - https://github.com/NVIDIA/garak/blob/main/garak/probes/malwaregen.py
    - https://attack.mitre.org/techniques/T1003/
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detecting prompts that request code to read high-value credential files (e.g., /etc/shadow, SAM hive, SSH private keys) directly evidences security/resilience evaluation; MS.2.7 requires continuous assessment of attempts to misuse the LLM for credential-harvesting code generation.
      strength: primary
    - subcategory: MS.2.10
      context: Credential and secret files contain highly sensitive authentication material; flagging requests to programmatically read them produces evidence for ongoing privacy risk assessment as required by MS.2.10.
      strength: secondary
    - subcategory: MG.2.3
      context: Matches on credential-file-read code generation requests trigger pre-defined risk treatment to block or disengage the offending session before malicious code is produced and executed downstream, as required by MG.2.3.
      strength: secondary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Credential File Read Code Generation Request).
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Credential File Read Code Generation Request).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Credential File Read Code Generation Request).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Credential File Read Code Generation Request) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Credential File Read Code Generation Request).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Credential File Read Code Generation Request).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: credential-file-read-gen
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: (?:write|generate|create|give\s+me|show\s+me)\s+(?:\w+\s+){0,4}code\s+to\s+read\s+(?:the\s+)?(?:encrypted\s+)?(?:system\s+)?password\s+file\b
      description: Generic "password file" read request - matches garak SubFunctions base prompt
    - field: tool_response
      operator: regex
      value: (?:read|dump|extract|exfiltrate|copy|cat|grep)\s+(?:the\s+)?(?:contents\s+of\s+)?(?:/etc/(?:shadow|passwd|gshadow|master\.passwd|sudoers)|/var/(?:lib/authn|db/sudo))\b
      description: Specific Unix credential file path
    - field: tool_response
      operator: regex
      value: (?:read|dump|extract)\s+(?:the\s+)?(?:windows\\system32\\config\\(?:sam|security)|c:\\windows\\system32\\config\\(?:sam|security)|%systemroot%\\system32\\config\\(?:sam|security))
      description: Windows SAM / SECURITY hive path (case-insensitive SAM hive location)
    - field: tool_response
      operator: regex
      value: (?:read|extract|parse)\s+(?:\w+\s+){0,3}(?:~/\.ssh/id_(?:rsa|dsa|ed25519|ecdsa)|\.ssh/authorized_keys|known_hosts|\.aws/credentials|\.gcloud/credentials|\.azure/credentials|\.kube/config|\.netrc|\.git-credentials)
      description: SSH private key or cloud/kubernetes credential file path
    - field: tool_response
      operator: regex
      value: (?:read|fetch|query|curl|wget|request)\s+(?:https?://)?(?:[\w.]+\s+){0,3}(?:169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com|imds(?:v\d+)?)/(?:latest/meta-data|computeMetadata|metadata)
      description: Cloud instance metadata service (IMDS/GCP/Azure) fetch - credential exfil vector
  condition: any
  false_positives:
    - sysadmin scripts that legitimately read /etc/passwd for user enumeration (read-only stat)
    - cron-job documentation discussing /etc/shadow for password aging policies
    - security-research blog posts describing credential-theft techniques defensively
    - legitimate ssh-config tooling that parses ~/.ssh/config (not private keys)
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00263] Credential-file read code-generation request detected - target file has no legitimate automation use case.