# Agent Disabling of Host Security Controls

- **Severity:** High
- **Signature ID:** `131bbe6b-166c-48c3-9dbf-3ed482af559f`
- **MITRE ATLAS:** AML.T0011 (User Execution)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM06 (Excessive Agency)

## Summary

This detects when an AI agent with system access is made to run commands that disable host defenses, such as stopping the firewall, turning off SELinux/AppArmor, killing the audit daemon, stopping antivirus/EDR software, or wiping shell history. These are the same steps a human attacker would take to blind a system before or during an intrusion, just carried out through an agent's tool calls instead of by hand.

## How the attack works

An attacker gets an AI agent to execute a command line action, either through a malicious prompt, a compromised task, or a manipulated tool call. The command targets a specific, named security control: flushing firewall rules, disabling SELinux/AppArmor enforcement, stopping or clearing the audit daemon, stopping an EDR or antivirus service, or clearing shell history to erase evidence. The rule looks for explicit disable, stop, flush, or clear actions against these named controls, not just reading their status. Once the control is down, the attacker has a window to operate without logging, alerting, or containment.

## Why it matters

An organisation loses its ability to detect or contain an intrusion in progress: logs stop, alerts stop firing, and traces of the attacker's activity are erased, extending dwell time and hiding the scope of a breach.

## What you can do

- Restrict which commands an agent is allowed to run against security services, firewalls, and audit tools; require human approval for anything that stops or disables them.
- Alert on any agent-initiated command that stops, flushes, or clears a named security control, and treat it as high priority even if the agent claims it is for maintenance.
- Send audit and security-tool logs to a location the agent cannot write to or clear, so disabling the local daemon does not erase the evidence.
- Review known maintenance windows and CI jobs that legitimately stop these controls, and scope those exceptions narrowly so they can't be used as cover.

## Known benign look-alikes

- A sanctioned maintenance window that briefly stops a security agent for an upgrade (context-dependent)
- A CI job that resets iptables in an isolated throwaway container

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01993

---
Source: https://www.netzilo.com/threats/atr-agent-disabling-of-host-security-controls