> ## Documentation Index > Fetch the complete documentation index at: https://aspex.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Rules > 225+ rules across three families. Every finding maps to OWASP LLM Top 10 2025, MITRE ATLAS and CWE, and carries a severity. | Family | Prefix | Count | Produced by | | ------------ | ------ | ----- | -------------------------------------------------------------------------- | | Attack paths | `AP` | 6 | `aspex scan`: compositions across servers | | Scan rules | `MCP` | 140+ | `aspex scan`: configuration, tool schemas, resource URIs, dynamic behavior | | Trace rules | `AT` | 85+ | `aspex trace`: recorded sessions from native client logs | | Hook rules | `HOOK` | 6 | `aspex scan hooks`: lifecycle hook commands | Substring rules live in [`internal/rules/catalog_rules.yaml`](https://github.com/aspex-security/aspex/blob/main/internal/rules/catalog_rules.yaml): data, not code. Adding one is a YAML entry plus a corpus fixture. [Contributing →](#contributing-a-rule) ## Attack paths (AP001–AP006) Conclusions about compositions, not observations. Each names two capabilities, the evidence for both, the path hop by hop, the impact and a remediation. | ID | Composition | Highest | | ----- | ------------------------------------------------------------------------------- | -------- | | AP001 | Local file read + network egress or external channel | critical | | AP002 | Credential or environment read + egress | critical | | AP003 | External content ingress + writable agent config, hooks, instructions or memory | critical | | AP004 | External content ingress + persistent memory write | medium | | AP005 | Command execution + open egress | critical | | AP006 | External content ingress + command execution, no open egress | high | [Severity and confidence rules →](/concepts/capabilities-and-attack-paths) ## Scan rules (MCP) | Category | Rules | Catches | | -------------------------- | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Prompt injection** | MCP001, 002, 018, 151–156 | Hidden Unicode, "ignore previous instructions", homoglyph tool names, injection phrases in prompt descriptions | | **Code execution** | MCP003, 020, 027–034 | `run_command`, `bash`, `eval_code`, container exec, kubectl exec, language REPLs, build system invocations | | **Credential access** | MCP006, 011, 014, 035–041, 093 | Plaintext secrets in config env (literal values only; cloud/DB/private keys CRITICAL, scoped API tokens HIGH), `get_env`, browser cookies/keychain, Vault reads, SSH key extraction | | **Data exfiltration** | MCP042–047 | Email send, Slack/Teams post, webhooks, S3/GCS upload, FTP upload, pastebin | | **Filesystem** | MCP004, 008, 017 | Arbitrary write, cron/LaunchAgent/rc-file persistence, CI/CD config write | | **Agent-trusted state** | MCP200 | A writable root that reaches the agent's own config, hooks, instruction or memory files. Global/executable state HIGH; project `.mcp.json` MEDIUM; instruction files LOW | | **Persistence** | MCP063–068 | Windows registry Run keys, login items, daemons, systemd units, scheduled tasks | | **Surveillance** | MCP012, 013, 048–053 | Clipboard, screen capture, microphone, camera, keystrokes, location | | **Recon** | MCP009, 024, 054–056 | Process spawn, port scan, user/AD enumeration, cloud resource enumeration | | **Cloud & infrastructure** | MCP057–062, 096–100 | IAM changes, firewall rules, compute provisioning, DNS changes, audit trail disable | | **Defense evasion** | MCP069–075 | Log clearing, AV/EDR exclusion, shadow copy deletion, timestomping | | **Privilege escalation** | MCP076–079 | Sudo execution, setuid/capability add, sudoers write, process injection | | **Network attacks** | MCP082–085, 101–107 | Reverse shell, port forwarding, DNS tunnel, Tor proxy, packet capture, ARP spoof, TLS interception | | **Supply chain** | MCP007, 022, 032, 033 | `@latest`/`@next` tags, manifest writes, package installs, build hooks | | **Remote server** | MCP010, 021 | No auth token, plaintext HTTP transport | | **Attack surface** | MCP019, 025, 026 | No input schema, duplicate tool names, >30 tools | | **Schema-based** | MCP121–125 | Schema accepts `shell_command`, `sudo_password`, `private_key`, AWS secret key | | **Resource URIs** | MCP130–140 | `/etc/shadow`, SSH keys, `.aws/credentials`, `.env`, private key files, executable MIME types | ## Trace rules (AT) Evaluated on recorded sessions; no proxy or runtime dependency. Stateful rules (AT011 error burst, AT013 mass enumeration, AT015 cross-server chain) track state across the whole session. | Category | Rules | Catches | | --------------------------- | ------------------------ | --------------------------------------------------------------------------------------------- | | **Credential file access** | AT001, 021–025 | `.env`, `.ssh/id_rsa`, `.aws/credentials`, kubeconfig, browser password stores | | **Code execution** | AT003 | Shell tool invocations from MCP servers | | **Reverse shell / payload** | AT026–030 | Netcat/Python reverse shells, curl-pipe-to-shell, base64 commands, eval of downloaded content | | **Exfiltration** | AT002, 015, 017, 031–035 | Outbound URLs, cross-server data chains, database dumps, S3 upload, webhooks, email, FTP/SFTP | | **Persistence writes** | AT006, 014, 036–040 | LaunchAgent/Daemon plists, registry Run keys, crontab, systemd units, shell init files | | **Privilege escalation** | AT041–043 | Sudo in args, SUID/capability manipulation, sudoers write | | **Defense evasion** | AT044–047 | Log clearing, history deletion, AV exclusion add, timestomping | | **Cloud & infrastructure** | AT048–050 | IAM modification, firewall rule add, CloudTrail disable | | **Container** | AT051–053 | Container exec, privileged flags, kubectl apply | | **Surveillance** | AT019, 020 | Clipboard read, screen capture | | **Recon** | AT012, 013, 018, 071–073 | Other-user home dirs, port scan, mass file enumeration, AD/domain recon, network discovery | | **Supply chain** | AT009, 074–076 | Manifest writes, package installs, dependency confusion flags, build hook modification | | **Obfuscation / staging** | AT060–063 | Hex/octal-encoded commands, IFS manipulation, memory dump tools, Windows token stealing | | **Cryptocurrency** | AT067, 068 | Transfer initiated, wallet seed phrase in arguments | | **C2 / malware** | AT081–084 | psexec/wmiexec, Cobalt Strike, Metasploit, rootkit tools | | **Sensitive data in args** | AT055, 056, 069, 070 | Private key PEM block, TOTP seed, AWS access key prefix, GitHub token prefix | | **Anomalous patterns** | AT004, 005, 011 | High-volume arguments, off-hours activity, error bursts | ## Agent hooks (HOOK000–HOOK005) | ID | Meaning | Severity | | ------- | ------------------------------------------------------------ | -------- | | HOOK001 | Hook fetches and executes remote code (curl\|sh, base64\|sh) | critical | | HOOK002 | Hook opens a reverse shell | critical | | HOOK003 | Hook reads credentials and reaches the network | high | | HOOK004 | Hook accesses sensitive paths | medium | | HOOK005 | Hook makes network calls | medium | | HOOK000 | Hook runs a command automatically (nothing suspicious) | info | ## Severity `--fail-on` (scan and trace) accepts these values. | Severity | Meaning | | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Critical** | Immediately exploitable, high impact: shell access, credential exfiltration, C2, active prompt injection in a loaded server. Remediate before using the server. | | **High** | Dangerous capability present even if not yet triggered, cleartext credential storage, missing authentication on a remote server. | | **Medium** | Broad filesystem grants, supply-chain ambiguity, missing input schema on a tool that accepts arbitrary arguments. | | **Low** | Verbose error messages, off-hours baseline deviations, tools with more than 30 endpoints. | `aspex scan --explain` expands every High and Critical finding into WHY, EXPLOIT, IMPACT and CONFIDENCE. ## Framework coverage LLM01 Prompt Injection · LLM02 Sensitive Information Disclosure · LLM03 Supply Chain · LLM06 Excessive Agency · LLM08 Excessive Permissions AML.T0010 ML Supply Chain Compromise · AML.T0043 Craft Adversarial Data · AML.T0048 Backdoor ML Model · AML.T0051 LLM Prompt Injection · AML.T0057 LLM Jailbreak CWE-20, 22, 77, 78, 89, 94, 116, 200, 214, 272, 284, 306, 307, 312, 319, 359, 522, 526, 732, 829, 918 ## Contributing a rule About 15 minutes: a YAML entry in `catalog_rules.yaml` (or a check function in `internal/rules` / `internal/trace` for stateful rules), a positive fixture that must fire and a negative fixture that must not, and a doc entry above. [CONTRIBUTING.md →](https://github.com/aspex-security/aspex/blob/main/CONTRIBUTING.md#adding-a-detection-rule)