Potential Prompt Injection Coercing Shell Execution
Detects shells or scripting interpreters launched from a parent command line that contains common LLM prompt-injection or jailbreak language. Attackers (or malicious content ingested by an agent) use…
Description
Detects shells or scripting interpreters launched from a parent command line that contains common LLM prompt-injection or jailbreak language. Attackers (or malicious content ingested by an agent) use instruction-override, DAN/developer- mode, system-prompt extraction, and safety-filter bypass phrasing to coerce GenAI coding agents and automation wrappers into running attacker-chosen commands. When that injected text reaches a child shell or interpreter, it is a strong signal that untrusted prompt content is crossing into local code execution, enabling credential theft, data exfiltration, persistence, or further tool abuse under the user's privileges.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source category
- event_index
Known benign triggers
- Approved red-team, evaluation, or detection-engineering tests that deliberately include jailbreak strings (such as DAN or "ignore previous instructions") in prompts or regex experiments run through GenAI agent shells. Exclude known lab hosts or lower severity after validation.
- Documentation that mentions "developer mode", "jailbreak", or "without restrictions" in a non-adversarial context. Review the full parent and child command lines before escalating.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
- T1059Command and Scripting Interpreter599 detections cover this technique
- T1059.001PowerShell378 detections cover this technique
- T1059.002AppleScript32 detections cover this technique
- T1059.003Windows Command Shell96 detections cover this technique
- T1059.004Unix Shell198 detections cover this technique
- T1059.005Visual Basic53 detections cover this technique
- T1059.006Python56 detections cover this technique
- T1059.007JavaScript69 detections cover this technique
References
| Reference | Cited by |
|---|---|
| cymulate.com/blog/cve-2025-547954-54795-claude-inverseprompt/ | Only this detection cites it |
| specterops.io/blog/2025/11/21/an-evening-with-claude-code/ | 2 |
| www.elastic.co/security-labs/elastic-advances-llm-security | 22 |
From the source
- At source
- Open at source
- Upstream identifier
- 30cb6dea-ce4d-4685-bd6c-9ff5b1904781
- Tagged by the source as
- Mitre Atlas: AML.T0051Mitre Atlas: AML.T0054Data Source: Elastic DefendDomain: EndpointDomain: GenAIOS: LinuxOS: macOSOS: WindowsPlatform: LinuxPlatform: macOSPlatform: WindowsResources: Investigation GuideRule Type: Event Correlation (EQL)Tactic: Defense EvasionTactic: ExecutionThreat: Unauthorized AI UsageUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Oct 17, 2026
- Version
- 1