Covert Server Intrusion — Process Injection, Log Tampering, DNS Hijack & Traffic Interception
This detects prompts that ask an AI agent with server or network access to perform intrusion-style actions — injecting code, wiping logs, hijacking DNS, sniffing traffic, or destroying a database — while explicitly framing it as covert or anti-forensic. It only fires when both an intrusion action and a stealth or anti-recovery phrase appear together, so normal IT operations language is excluded.
How the attack works
An attacker sends the agent an instruction combining two parts: a technical action (inject commands into a running process, alter logs, change DNS records, capture network traffic, modify data, or delete a database) and a qualifier that signals malicious intent (discreetly, hide traces, undetected, redirect users, intercept, prevent recovery). If the agent has infrastructure tooling and complies, it carries out an intrusion step — such as rerouting traffic via DNS or erasing evidence of access — without triggering normal suspicion because the wording resembles routine ops tasks. The rule catches this pairing regardless of which specific intrusion verb and qualifier are used.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a3977180-8e28-4262-a397-fa0ac059ac1c
- Severity
- Critical
Why it matters
An organization could lose control of network traffic (via DNS hijack or interception), lose forensic evidence of a breach (via log wiping), or lose data permanently (via database deletion) — with an AI agent acting as the unwitting operator.
What you can do
- →Restrict which agents can access server, DNS, logging, and database management tools, and require human approval for destructive or configuration-changing actions.
- →Log and review all agent-issued commands that touch DNS records, process memory, log files, or databases, independent of the agent's own reasoning trace.
- →Add explicit deny-rules for agent actions framed around stealth, hiding evidence, or preventing recovery, even if the underlying technical task looks legitimate.
- →Treat any instruction combining an infrastructure change with anti-forensic language as high-risk and route it for manual review before execution.
Known benign look-alikes
- Legitimate ops language: 'update DNS records to improve performance', 'modify firmware to enhance performance', 'monitor network traffic to ensure data security', 'securely delete outdated data as part of data hygiene' — none pair an intrusion verb with a covert/anti-forensic qualifier.
- Defensive directives to harden a process, monitor for crashes, or implement protections against code injection.
- Security research corpora cataloguing ASB attack strings as reference samples — should be allowlisted by a reviewer.