# Agent Subprocess DNS Exfiltration and Instruction-File Worm Propagation

- **Severity:** High
- **Signature ID:** `7f3c9a12-4d6e-4b58-9a21-c0e5f8d47b93`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0025 (Exfiltration via Cyber Means)
- **OWASP:** LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This rule watches commands run by AI agents for signs of three separate abuse techniques: hiding stolen data in DNS lookups, rewriting agent instruction files to infect the next agent that reads them, and smuggling invisible Unicode characters that carry hidden instructions past human reviewers. It only looks at process command lines, one event at a time.

## How the attack works

An attacker who has already compromised or manipulated an AI agent can make it exfiltrate data by encoding stolen information into a long alphanumeric subdomain and querying it with a DNS tool like dig or nslookup, using DNS traffic as a covert channel. Separately, a poisoned agent can rewrite shared instruction files (like CLAUDE.md, AGENTS.md, or .cursorrules) by combining a network fetch or decode step with a file write, so the next agent that reads the repository inherits the malicious instructions - a worm-like propagation step. A third pattern looks for invisible Unicode tag or bidirectional-override characters embedded in command arguments, a way to hide instructions from anyone reviewing the text visually.

## Why it matters

If missed, an organization can lose sensitive data through a channel that looks like ordinary DNS traffic, and a single compromised agent can silently spread malicious instructions to every other agent that reads the same shared configuration or documentation files.

## What you can do

- Restrict which processes and users can invoke DNS resolver tools (dig, nslookup, drill, host) from agent environments, and log/alert on unusual query name lengths or entropy.
- Treat agent instruction files (CLAUDE.md, AGENTS.md, .cursorrules, MCP configs, etc.) as sensitive: require code review and version control for any changes, and restrict write access from automated processes.
- Scan repository and configuration text for invisible Unicode tag or bidirectional control characters before agents ingest them.
- Review this as a report-only heuristic with an unmeasured false-positive rate — expect noise from legitimate hash-based lookups, UUID-based canaries, and content-addressed hostnames before tuning it further.

## Known benign look-alikes

- Hash-based blocklist or reputation lookups, where a 32-character hex digest is the leftmost label of the query name. These are structurally identical to DNS tunnelling and are not filtered, because filtering them would require trusting a third-party domain.
- DNS canary, RUM or measurement probes that embed a de-hyphenated UUID in the query name (32 continuous alphanumerics).
- Content-addressed hostnames from object stores or ephemeral preview environments resolved with dig during troubleshooting, when the generated label happens to be 26 or more characters with no separators.
- A developer or agent legitimately updating repository agent guidance in one shell line that also contains curl or base64 - for example fetching a team-standard AGENTS.md template and writing it into the repo during onboarding or CI bootstrap. This is the dominant expected false positive for the worm selection and the reason the rule is report-only.
- Provisioning scripts that render claude_desktop_config.json or .mcp.json from a downloaded template with curl -o.
- Command lines that legitimately carry bidirectional control characters when handling right-to-left filenames, translated strings or commit messages.
- Red-team reproductions and detection-engineering test fixtures replaying the Month of AI Bugs techniques in a lab.

## References

- https://attack.mitre.org/techniques/T1071/004/
- https://attack.mitre.org/techniques/T1048/003/
- https://attack.mitre.org/techniques/T1027/

---
Source: https://www.netzilo.com/threats/subprocess-dns-exfil-worm-propagation