# Terminal CLI Harmful Function Simulation

- **Severity:** High
- **Signature ID:** `7f3c1d2a-9b64-4e58-a1c7-5d0e93f2b6a4`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** LLM01 (Prompt Injection), ASI01 (Agent Authorization and Control Hijacking)

## Summary

This detects when an AI agent, likely manipulated by a prompt injection or jailbreak attempt, spawns a command-line process that either wipes critical system data or contains suspicious 'pretend to be a terminal' language. It flags the moment the agent actually executes or simulates a harmful command, not just receives the malicious instruction.

## How the attack works

An attacker embeds jailbreak or 'simulate a terminal' phrasing into content the AI agent processes, for example via a prompt injection. The agent, believing this is legitimate instruction, spawns a child process to run the command. The rule looks at the command line of that child process for two patterns: outright destructive or security-disabling commands targeting the filesystem root, system directories, raw disks, security controls, or backup/forensic files, or text carrying jailbreak/simulation framing. Harmless project-scoped cleanup, read-only inspection, help/version calls, and dry-run flags are excluded so normal admin work does not trigger it.

## Why it matters

If successful, this can destroy data, disable security controls like SIP, Gatekeeper, SELinux, firewalls, or endpoint protection, or wipe backup and forensic evidence — all carried out by an AI agent acting on attacker-supplied instructions rather than the operator's intent.

## What you can do

- Restrict which directories and devices an AI agent's execution environment can target, especially filesystem root, system directories, and raw block devices.
- Require human approval before an agent executes any command that disables security controls or deletes system-level paths.
- Review agent logs for jailbreak-style phrasing (e.g. 'simulate a terminal', 'ignore previous instructions') appearing in command arguments.
- Expect and whitelist known benign patterns such as disposable CI/container image-slimming scripts or disk provisioning jobs to reduce noise before rolling out stricter controls.

## Known benign look-alikes

- Disposable CI/container bootstrap scripts that legitimately run "rm -rf /var/..." or "rm -rf /usr/share/doc" style image slimming inside a throwaway rootfs.
- Disk provisioning or imaging automation that legitimately calls dd/mkfs/wipefs against a raw block device on a machine being reimaged.
- Endpoint-security or platform engineers toggling SIP, Gatekeeper, SELinux, ufw/firewalld or Defender real-time protection in a lab or during a controlled software installation.
- Shell hygiene in secret-handling scripts that run "unset HISTFILE" or "export HISTFILE=/dev/null" before echoing a token.
- Red-team, prompt-injection test harnesses and security training tooling that pass jailbreak strings on the command line; the read-only-inspection and --dry-run filters remove the common grep/echo/--help forms but a bespoke harness (e.g. "python run_injection_suite.py --prompt 'ignore all previous instructions'") will still report.
- Chaos-engineering or backup/restore drills that intentionally delete shadow copies or disable recovery on a scratch host.

## References

- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1485/
- https://attack.mitre.org/techniques/T1562/001/
- https://attack.mitre.org/techniques/T1490/

---
Source: https://www.netzilo.com/threats/terminal-cli-harmful-function-simulator