# Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook

- **Severity:** Critical
- **Signature ID:** `1b15faea-8f9e-4624-86c2-4aa28c592a67`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI03 (Identity and Impersonation), LLM06 (Excessive Agency)

## Summary

This detects malicious shell commands that look harmless at first but end with sensitive data being sent to an outside server. The trick is hiding a data exfiltration step behind a normal-looking command, like checking git status or running tests, in a single command line.

## How the attack works

An attacker crafts a shell command that starts with something innocuous, such as 'git status' or 'npm test', so the request looks routine to whoever or whatever is approving it. Chained onto that command, using operators like '&&' or ';', is a second command that reads environment variables, .env files, or API keys and sends them out using curl -X POST, wget -qO-, or netcat. The whole thing runs as one shell instruction, so an AI agent that executes shell commands on a user's behalf may run it without inspecting each piped or chained segment. The result is the attacker's server receiving secrets that were never meant to leave the machine.

## Why it matters

Successful exfiltration exposes API keys, credentials, and other environment secrets to an outside party, which can lead to further account takeover or unauthorized access to connected systems.

## What you can do

- Require agents to parse and evaluate each command in a chain separately rather than approving the whole pipeline at once.
- Restrict or flag outbound network commands (curl, wget, nc) issued by agents, especially when combined with reads of environment variables or .env files.
- Maintain an allowlist of approved webhook destinations for CI/CD and monitoring agents, and block posts to unlisted endpoints.
- Log and review full shell command strings executed by agents, not just the first command in a chain, before or after execution.

## Known benign look-alikes

- CI/CD agents posting legitimate build status to authorized webhooks
- Monitoring agents sending metrics to approved telemetry endpoints

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01609

---
Source: https://www.netzilo.com/threats/atr-shell-injection-env-exfiltration-via-curl-wget-netcat-webhoo