# Agent-Initiated Internal Network Service Sweep

- **Severity:** High
- **Signature ID:** `f856b4b2-0c58-4eaf-914a-3120d4d3006a`
- **MITRE ATLAS:** AML.T0011 (User Execution)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

This rule flags an AI agent that runs a broad network scan across many hosts and ports instead of checking a single known address. That kind of sweep is normally what an attacker does before trying to move deeper into a network, and it's a sign the agent has been steered into doing more than its task requires.

## How the attack works

An attacker manipulates the agent's instructions or goals so it issues a tool call that scans a whole subnet or IP range across many ports, using nmap/masscan-style flags or an equivalent scripted loop. This maps out which internal hosts and services are reachable. The result gives the attacker a list of live targets and open ports to attack next, i.e. the reconnaissance step before lateral movement. It differs from a normal single host:port connectivity check, which this rule does not flag.

## Why it matters

If successful, an attacker gets a map of internal hosts and open services, information used to plan further intrusion into other systems on the network. The rule only catches this reconnaissance step, not any later exploitation.

## What you can do

- Restrict the agent's network egress so it cannot reach internal subnets it has no legitimate reason to touch.
- Require explicit approval before an agent runs any command matching CIDR ranges plus port ranges.
- Allowlist known, authorized scanning tools and accounts (e.g. security team vulnerability scans) so real alerts stand out.
- Review agent instructions and skill prompts for language that could be manipulated into requesting broad network scans.

## Known benign look-alikes

- Authorized internal vulnerability scanning by a security team (context-dependent, requires allowlisting the agent)
- A documented single scan command referenced in security training material

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01989

---
Source: https://www.netzilo.com/threats/atr-agent-initiated-internal-network-service-sweep