Rules

Family	Prefix	Count	Produced by
Attack paths	`AP`	6	`aspex scan`: compositions across servers
Scan rules	`MCP`	140+	`aspex scan`: configuration, tool schemas, resource URIs, dynamic behavior
Trace rules	`AT`	85+	`aspex trace`: recorded sessions from native client logs
Hook rules	`HOOK`	6	`aspex scan hooks`: lifecycle hook commands

Substring rules live in internal/rules/catalog_rules.yaml: data, not code. Adding one is a YAML entry plus a corpus fixture. Contributing →

Attack paths (AP001–AP006)

Conclusions about compositions, not observations. Each names two capabilities, the evidence for both, the path hop by hop, the impact and a remediation.

ID	Composition	Highest
AP001	Local file read + network egress or external channel	critical
AP002	Credential or environment read + egress	critical
AP003	External content ingress + writable agent config, hooks, instructions or memory	critical
AP004	External content ingress + persistent memory write	medium
AP005	Command execution + open egress	critical
AP006	External content ingress + command execution, no open egress	high

Severity and confidence rules →

Scan rules (MCP)

Category	Rules	Catches
Prompt injection	MCP001, 002, 018, 151–156	Hidden Unicode, “ignore previous instructions”, homoglyph tool names, injection phrases in prompt descriptions
Code execution	MCP003, 020, 027–034	`run_command`, `bash`, `eval_code`, container exec, kubectl exec, language REPLs, build system invocations
Credential access	MCP006, 011, 014, 035–041, 093	Plaintext secrets in config env (literal values only; cloud/DB/private keys CRITICAL, scoped API tokens HIGH), `get_env`, browser cookies/keychain, Vault reads, SSH key extraction
Data exfiltration	MCP042–047	Email send, Slack/Teams post, webhooks, S3/GCS upload, FTP upload, pastebin
Filesystem	MCP004, 008, 017	Arbitrary write, cron/LaunchAgent/rc-file persistence, CI/CD config write
Agent-trusted state	MCP200	A writable root that reaches the agent’s own config, hooks, instruction or memory files. Global/executable state HIGH; project `.mcp.json` MEDIUM; instruction files LOW
Persistence	MCP063–068	Windows registry Run keys, login items, daemons, systemd units, scheduled tasks
Surveillance	MCP012, 013, 048–053	Clipboard, screen capture, microphone, camera, keystrokes, location
Recon	MCP009, 024, 054–056	Process spawn, port scan, user/AD enumeration, cloud resource enumeration
Cloud & infrastructure	MCP057–062, 096–100	IAM changes, firewall rules, compute provisioning, DNS changes, audit trail disable
Defense evasion	MCP069–075	Log clearing, AV/EDR exclusion, shadow copy deletion, timestomping
Privilege escalation	MCP076–079	Sudo execution, setuid/capability add, sudoers write, process injection
Network attacks	MCP082–085, 101–107	Reverse shell, port forwarding, DNS tunnel, Tor proxy, packet capture, ARP spoof, TLS interception
Supply chain	MCP007, 022, 032, 033	`@latest`/`@next` tags, manifest writes, package installs, build hooks
Remote server	MCP010, 021	No auth token, plaintext HTTP transport
Attack surface	MCP019, 025, 026	No input schema, duplicate tool names, >30 tools
Schema-based	MCP121–125	Schema accepts `shell_command`, `sudo_password`, `private_key`, AWS secret key
Resource URIs	MCP130–140	`/etc/shadow`, SSH keys, `.aws/credentials`, `.env`, private key files, executable MIME types

Trace rules (AT)

Evaluated on recorded sessions; no proxy or runtime dependency. Stateful rules (AT011 error burst, AT013 mass enumeration, AT015 cross-server chain) track state across the whole session.

Category	Rules	Catches
Credential file access	AT001, 021–025	`.env`, `.ssh/id_rsa`, `.aws/credentials`, kubeconfig, browser password stores
Code execution	AT003	Shell tool invocations from MCP servers
Reverse shell / payload	AT026–030	Netcat/Python reverse shells, curl-pipe-to-shell, base64 commands, eval of downloaded content
Exfiltration	AT002, 015, 017, 031–035	Outbound URLs, cross-server data chains, database dumps, S3 upload, webhooks, email, FTP/SFTP
Persistence writes	AT006, 014, 036–040	LaunchAgent/Daemon plists, registry Run keys, crontab, systemd units, shell init files
Privilege escalation	AT041–043	Sudo in args, SUID/capability manipulation, sudoers write
Defense evasion	AT044–047	Log clearing, history deletion, AV exclusion add, timestomping
Cloud & infrastructure	AT048–050	IAM modification, firewall rule add, CloudTrail disable
Container	AT051–053	Container exec, privileged flags, kubectl apply
Surveillance	AT019, 020	Clipboard read, screen capture
Recon	AT012, 013, 018, 071–073	Other-user home dirs, port scan, mass file enumeration, AD/domain recon, network discovery
Supply chain	AT009, 074–076	Manifest writes, package installs, dependency confusion flags, build hook modification
Obfuscation / staging	AT060–063	Hex/octal-encoded commands, IFS manipulation, memory dump tools, Windows token stealing
Cryptocurrency	AT067, 068	Transfer initiated, wallet seed phrase in arguments
C2 / malware	AT081–084	psexec/wmiexec, Cobalt Strike, Metasploit, rootkit tools
Sensitive data in args	AT055, 056, 069, 070	Private key PEM block, TOTP seed, AWS access key prefix, GitHub token prefix
Anomalous patterns	AT004, 005, 011	High-volume arguments, off-hours activity, error bursts

Agent hooks (HOOK000–HOOK005)

ID	Meaning	Severity
HOOK001	Hook fetches and executes remote code (curl\|sh, base64\|sh)	critical
HOOK002	Hook opens a reverse shell	critical
HOOK003	Hook reads credentials and reaches the network	high
HOOK004	Hook accesses sensitive paths	medium
HOOK005	Hook makes network calls	medium
HOOK000	Hook runs a command automatically (nothing suspicious)	info

Severity

--fail-on (scan and trace) accepts these values.

Severity	Meaning
Critical	Immediately exploitable, high impact: shell access, credential exfiltration, C2, active prompt injection in a loaded server. Remediate before using the server.
High	Dangerous capability present even if not yet triggered, cleartext credential storage, missing authentication on a remote server.
Medium	Broad filesystem grants, supply-chain ambiguity, missing input schema on a tool that accepts arbitrary arguments.
Low	Verbose error messages, off-hours baseline deviations, tools with more than 30 endpoints.

aspex scan --explain expands every High and Critical finding into WHY, EXPLOIT, IMPACT and CONFIDENCE.

Framework coverage

OWASP LLM Top 10 2025
MITRE ATLAS
CWE

LLM01 Prompt Injection · LLM02 Sensitive Information Disclosure · LLM03 Supply Chain · LLM06 Excessive Agency · LLM08 Excessive Permissions

Contributing a rule

About 15 minutes: a YAML entry in catalog_rules.yaml (or a check function in internal/rules / internal/trace for stateful rules), a positive fixture that must fire and a negative fixture that must not, and a doc entry above. CONTRIBUTING.md →

Start

Concepts

Commands

Guides

Reference

Attack paths (AP001–AP006)

Scan rules (MCP)

Trace rules (AT)

Agent hooks (HOOK000–HOOK005)

Severity

Framework coverage

Contributing a rule

​Attack paths (AP001–AP006)

​Scan rules (MCP)

​Trace rules (AT)

​Agent hooks (HOOK000–HOOK005)

​Severity

​Framework coverage

​Contributing a rule

Attack paths (AP001–AP006)

Scan rules (MCP)

Trace rules (AT)

Agent hooks (HOOK000–HOOK005)

Severity

Framework coverage

Contributing a rule