# Goblin Red-Team Strategy Execution

- **Severity:** Medium
- **Signature ID:** `3f8c1e6a-9d24-4b71-8e5f-2a7c04b19d63`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This rule flags when someone runs the 'goblin' red-teaming strategy from the promptfoo tool against an AI agent. Goblin is an automated attack generator that sends many crafted prompts in a row to try to jailbreak or manipulate an AI system, often pulling its attack instructions from an external server.

## How the attack works

An attacker or tester launches a process with command-line flags identifying the goblin strategy (such as 'promptfoo:redteam:goblin' or '--strategy goblin'). Shortly after, that process or the AI agent sends a burst of at least three requests to the LLM within a 15-minute window — the multi-turn attack pattern goblin uses to iteratively probe the model. Around the same time, the tool may fetch its attack prompts from a public internet endpoint rather than generating them locally. The rule stitches these three observable signals together since it cannot directly see the attack's internal logic.

## Why it matters

If unauthorized, this represents an active attempt to jailbreak or extract unintended behavior from an AI agent through repeated automated probing, which could bypass safety controls or extract sensitive information the agent has access to.

## What you can do

- Treat every alert as a report to investigate, not a confirmed incident — the rule is explicitly report-only.
- Check whether the activity matches a known, authorized red-team engagement or CI test; if so, log the correlation and close it out.
- If unauthorized, review what the AI agent was asked to do during the multi-turn burst and what data or tools it had access to.
- Restrict which processes or accounts can invoke red-teaming tools like promptfoo against production AI agents, and monitor outbound requests to public endpoints that supply prompts.

## Known benign look-alikes

- Authorized red-team exercises or CI pipelines that intentionally enable the goblin strategy in a promptfoo config — expected to fire; correlate with the change or engagement ticket. The rule is report-only for exactly this reason.
- Developers re-running a stored promptfoo config for regression testing where the goblin strategy name is still present in the YAML passed on the command line.
- Security research or training repositories where a directory, package, fixture or branch is literally named "goblin" and is executed next to jailbreak/red-team fixtures; the weak-marker path requires a red-team context token AND at least one graph-corroborated stage before it will report.
- Unrelated third-party software named "goblin" spawned during a session that also happens to make several LLM calls; mitigated by requiring a goblin identity marker (not the bare word) or a red-team context token on the same command line.

## References

- https://www.promptfoo.dev/docs/red-team/strategies/
- https://atlas.mitre.org/techniques/AML.T0054
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/

---
Source: https://www.netzilo.com/threats/goblin-redteam-strategy