Add rule for LLM agent indirect prompt injection detection

This Sigma rule detects potential indirect prompt injection manipulation and data exfiltration attempts by monitoring specific command line patterns and parent images in a Linux environment.

Author: Batina-Jennifer

rules/application/app_llm_agent_indirect_prompt_injection_detection.yaml

@@ -0,0 +1,43 @@
+# This is a Sigma rule to detect potential LLM agent indirect prompt injection manipulation and data exfiltration attempts.
+# This is Part 1: The Metadata
+title: Potential LLM Agent Indirect Prompt Injection Manipulation and Data Exfiltration
+id: 8fd66b71-7969-4d81-904f-29e772d1d6c6
+status: experimental
+description: Detects a multi-stage indirect prompt injection attack pattern where an enterprise LLM agent processes data containing adversarial override payloads and subsequently initiates an outbound network connection(for data exfiltration) to an unapproved external domain(C2) or RCE. 
+references:
+  - https://genai.owasp.org/llm-top-10/
+author: Jennifer Batina
+date: 2026/07/03
+tags:
+  - attack.exfiltration   #MITRE ATT&CK technique T1041 (C2)
+  - owasp.llm01           #Prompt Injection
+  - owasp.llm02           #Insecure Output Handling
+logsource:
+  category: process_creation
+  product: linux
+# This is Part 2: The Detection Logic
+detection:
+  selection_agent_runtime:
+    ParentImage|endswith:
+      - '/python'          # Standard Python environment execution
+      - '/python3'         # Modern Python environment execution
+      - '/celery'          # Background asynchronous task queues
+  selection_injection_payloads:
+    CommandLine|contains:
+      #Attacks forcing native tools to execute commands or download tools.
+      - 'curl'             # Outbound data exfiltration requests
+      - 'wget'             # Staging external script downloads
+      - 'chmod +x'         # Making payload files executable
+      - 'sh -i'            # Interactive terminal shell invocation or spawning
+      - 'bash -i'          # Interactive bash or reverse shell connections
+      # Data exfiltration commands acting as environmental reads.
+      - 'printenv'         # Dumping application API keys
+      - 'cat /etc/passwd'  # Reading system user account information or user lists
+      - 'cat /etc/shadow'  # Reading system password hashes
+      - 'cat /app/.env'    # Stealing application configuration secrets
+  condition: selection_agent_runtime and selection_injection_payloads
+# This is Part 3: The Operational Context
+falsepositives:
+  - Red team simulations or automated security assessments testing LLM guardrails.
+  - Developers testing complex instruction-following prompts inside sandboxed environments or applications.
+level: critical