# Covert Server Intrusion — Process Injection, Log Tampering, DNS Hijack & Traffic Interception

- **Severity:** Critical
- **Signature ID:** `a3977180-8e28-4262-a397-fa0ac059ac1c`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM08 (Vector and Embedding Weaknesses)

## Summary

This detects prompts that ask an AI agent with server or network access to perform intrusion-style actions — injecting code, wiping logs, hijacking DNS, sniffing traffic, or destroying a database — while explicitly framing it as covert or anti-forensic. It only fires when both an intrusion action and a stealth or anti-recovery phrase appear together, so normal IT operations language is excluded.

## How the attack works

An attacker sends the agent an instruction combining two parts: a technical action (inject commands into a running process, alter logs, change DNS records, capture network traffic, modify data, or delete a database) and a qualifier that signals malicious intent (discreetly, hide traces, undetected, redirect users, intercept, prevent recovery). If the agent has infrastructure tooling and complies, it carries out an intrusion step — such as rerouting traffic via DNS or erasing evidence of access — without triggering normal suspicion because the wording resembles routine ops tasks. The rule catches this pairing regardless of which specific intrusion verb and qualifier are used.

## Why it matters

An organization could lose control of network traffic (via DNS hijack or interception), lose forensic evidence of a breach (via log wiping), or lose data permanently (via database deletion) — with an AI agent acting as the unwitting operator.

## What you can do

- Restrict which agents can access server, DNS, logging, and database management tools, and require human approval for destructive or configuration-changing actions.
- Log and review all agent-issued commands that touch DNS records, process memory, log files, or databases, independent of the agent's own reasoning trace.
- Add explicit deny-rules for agent actions framed around stealth, hiding evidence, or preventing recovery, even if the underlying technical task looks legitimate.
- Treat any instruction combining an infrastructure change with anti-forensic language as high-risk and route it for manual review before execution.

## Known benign look-alikes

- Legitimate ops language: 'update DNS records to improve performance', 'modify firmware to enhance performance', 'monitor network traffic to ensure data security', 'securely delete outdated data as part of data hygiene' — none pair an intrusion verb with a covert/anti-forensic qualifier.
- Defensive directives to harden a process, monitor for crashes, or implement protections against code injection.
- Security research corpora cataloguing ASB attack strings as reference samples — should be allowlisted by a reviewer.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01803

---
Source: https://www.netzilo.com/threats/atr-covert-server-intrusion-process-injection-log-tampering-dns