title: Malware Dropper / Loader Code Generation Request
id: ATR-2026-00266
rule_version: 1
status: experimental
description: |
  Detects prompts asking the LLM to generate dropper, loader, stager, or downloader malware — code whose primary purpose is to fetch and execute a second-stage payload. From NVIDIA garak malwaregen.Dropper probe. Distinct from generic malware generation: dropper-specific language ("stage-0", "beacon", "shellcode loader", "download and exec", "reflective PE") signals active exploitation infrastructure, not just harmful scripts.
author: ATR Community (via NVIDIA garak malwaregen.Dropper probe)
date: 2026/04/19
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM01:2025
  owasp_agentic:
    - ASI05:2026
    - ASI01:2026
  mitre_atlas:
    - AML.T0102 - Generate Malicious Commands
  research:
    - https://github.com/NVIDIA/garak/blob/main/garak/probes/malwaregen.py
    - https://attack.mitre.org/techniques/T1105/
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.6
      context: Detection of dropper/loader/stager code-generation requests directly evidences continuous evaluation of the AI system's safety/security risk magnitude; MS.2.6 requires ongoing measurement of misuse attempts that produce active exploitation infrastructure.
      strength: primary
    - subcategory: MG.2.3
      context: Identifying requests for stage-0 beacons, shellcode loaders, and reflective PE payloads must trigger pre-defined risk treatment such as refusal or session termination; MG.2.3 requires mechanisms to disengage or supersede the AI system before it produces second-stage payload delivery code.
      strength: secondary
    - subcategory: MP.5.1
      context: Dropper-specific prompt patterns represent a high-magnitude adversarial misuse vector targeting the model's code-generation capability; MP.5.1 requires that the likelihood and impact of such weaponization risks are characterized and tracked.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (Malware Dropper / Loader Code Generation Request).
      strength: primary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Malware Dropper / Loader Code Generation Request).
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Malware Dropper / Loader Code Generation Request).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Malware Dropper / Loader Code Generation Request).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Malware Dropper / Loader Code Generation Request) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Malware Dropper / Loader Code Generation Request).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Malware Dropper / Loader Code Generation Request).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: malware-dropper-gen
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: (?:write|generate|create|give\s+me|code\s+me)\s+(?:\w+\s+){0,4}(?:a\s+)?(?:malware\s+)?(?:dropper|downloader|loader|stager|stage[\s-]?0|stage[\s-]?1|beacon|implant|rat|remote\s+access\s+(?:tool|trojan))\b
      description: Direct dropper/loader/stager code-gen request
    - field: tool_response
      operator: regex
      value: (?:download\s+(?:and\s+)?(?:execute|run|launch|spawn)|fetch\s+(?:and\s+)?execute|pull\s+(?:and\s+)?run)\s+(?:shellcode|payload|exe|binary|pe\s+file|elf\s+binary|second[\s-]stage)
      description: '"Download and execute" pattern for second-stage payload delivery'
    - field: tool_response
      operator: regex
      value: (?:write|generate|create)\s+(?:\w+\s+){0,4}(?:shellcode\s+loader|pe\s+loader|reflective\s+(?:pe|loader|dll)|in[\s-]?memory\s+(?:execution|loader|pe)|fileless\s+(?:malware|execution|loader))
      description: In-memory / reflective / fileless loader - advanced dropper techniques
    - field: tool_response
      operator: regex
      value: (?:write|generate|implement|code)\s+(?:\w+\s+){0,4}(?:c2\s+(?:client|beacon|agent)|command[\s-]and[\s-]control\s+(?:client|agent)|reverse\s+(?:shell|tcp\s+shell|meterpreter))\b
      description: C2 beacon or reverse shell - operational malware infrastructure
    - field: tool_response
      operator: regex
      value: (?:persistence\s+mechanism|establish\s+persistence|add\s+(?:to\s+)?(?:startup|registry\s+run|crontab|launchd|systemd\s+service)|maintain\s+(?:access|foothold))\s+(?:after|on|via|using)
      description: Persistence establishment code-gen request - dropper post-execution step
  condition: any
  false_positives:
    - CTF challenge write-ups describing dropper mechanics defensively
    - Red-team training materials with educational malware analysis context
    - DFIR post-mortems describing observed dropper behaviour without code-gen request
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00266] Malware dropper/loader code generation request detected - second-stage payload delivery or C2 infrastructure.