# Malware Dropper / Loader Code Generation Request

- **Severity:** Critical
- **Signature ID:** `7a13b651-5ecf-471d-847d-cc203ddc051c`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM05 (Improper Output Handling)

## Summary

This detects someone asking an AI assistant to write code that fetches and runs a second-stage payload, such as a stager, beacon, or shellcode loader. That's a specific building block attackers use to get initial malware onto a system and then pull in the real payload.

## How the attack works

An attacker sends a prompt to an AI coding assistant requesting code for a dropper, loader, stager, or downloader. The prompt uses telltale phrasing like 'stage-0', 'beacon', 'shellcode loader', 'download and exec', or 'reflective PE injection' rather than generic malware terms. If the assistant complies, the attacker gets working code whose sole job is to retrieve and execute a further payload, skipping the effort of writing that infrastructure themselves. This is one narrow step — generating the delivery mechanism — not the full attack chain that follows.

## Why it matters

An organisation whose AI tool produces this code hands an attacker a ready-made piece of exploitation infrastructure, shortening the time needed to build a working intrusion toolkit and increasing the chance that generated code ends up used against the organisation's own or others' systems.

## What you can do

- Review AI assistant logs for prompts using dropper/stager/loader terminology and flag them for human review before any generated code is used.
- Distinguish defensive or educational requests (CTF write-ups, red-team training, DFIR analysis) from requests asking for new working dropper code, since these produce the same keywords but different intent.
- Restrict or gate AI coding assistants so code involving network fetch-and-execute patterns requires additional approval before being run or shared.
- Educate security and engineering staff that this detection covers only the code-generation request step, not full malware deployment, and should be paired with monitoring of what happens to any generated code.

## Known benign look-alikes

- CTF challenge write-ups describing dropper mechanics defensively
- Red-team training materials with educational malware analysis context
- DFIR post-mortems describing observed dropper behaviour without code-gen request

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00266
- https://github.com/NVIDIA/garak/blob/main/garak/probes/malwaregen.py
- https://attack.mitre.org/techniques/T1105/

---
Source: https://www.netzilo.com/threats/atr-malware-dropper-loader-code-generation-request