LoFP LoFP / approved red-team, evaluation, or detection-engineering tests that deliberately include jailbreak strings (such as dan or \"ignore previous instructions\") in prompts or regex experiments run through genai agent shells. exclude known lab hosts or lower severity after validation.

Techniques

Sample rules

Potential Prompt Injection Coercing Shell Execution

Description

Detects shells or scripting interpreters launched from a parent command line that contains common LLM prompt-injection or jailbreak language. Attackers (or malicious content ingested by an agent) use instruction-override, DAN/developer- mode, system-prompt extraction, and safety-filter bypass phrasing to coerce GenAI coding agents and automation wrappers into running attacker-chosen commands. When that injected text reaches a child shell or interpreter, it is a strong signal that untrusted prompt content is crossing into local code execution, enabling credential theft, data exfiltration, persistence, or further tool abuse under the user’s privileges.

Detection logic

process where event.type == "start" and event.action in ("exec", "start") and
(
  process.name like~ (
    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "mksh",
    "timeout", "env", "bun",
    "bash.exe", "sh.exe", "env.exe", "timeout.exe", "bun.exe",
    "cmd.exe", "powershell.exe", "pwsh", "pwsh.exe", "powershell_ise.exe",
    "osascript",
    "wscript.exe", "cscript.exe", "mshta.exe"
  ) or
  ?process.pe.original_file_name in (
    "Cmd.Exe", "PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE",
    "wscript.exe", "cscript.exe", "MSHTA.EXE"
  ) or
  process.name like~ (
    ".*",
    "python*", "perl*", "php*", "ruby*", "lua*", "node*", "deno*"
  )
) and
process.parent.command_line : (
  "*ignore previous instructions*", "*ignore prior instructions*",
  "*ignore all previous*", "*ignore your previous*",
  "*ignore the content policy*",
  "*disregard previous instructions*", "*disregard prior instructions*",
  "*disregard all previous*",
  "*disregard your system instructions*", "*disregard the system instructions*",
  "*disregard all system instructions*",
  "*disregard your developer instructions*", "*disregard the developer instructions*",
  "*dan mode*", "*stan mode*", "*aim mode*", "*dude mode*",
  "*do anything now*", "*you are dan*",
  "*bypass the safety*", "*bypass the safety filter*", "*bypass safety filter*",
  "*bypass the content filter*", "*bypass content filter*",
  "*bypass the content policy*", "*bypass content policy*",
  "*bypass your guidelines*",
  "*no safety filter*", "*no content restriction*",
  "*without any restrictions*", "*without your restrictions*",
  "*without content restrictions*", "*without safety restrictions*",
  "*unrestricted ai*", "*unrestricted developer mode*",
  "*jailbreak the*", "*jailbreak mode *", "*jailbreak mode,*", "*jailbreak mode.*",
  "*jailbreak mode!*", "*jailbreak prompt*",
  "*forget everything you were told*", "*forget previous instructions*",
  "*you are now in*developer mode*",
  "*override your safety*",
  "*hidden system prompt*",
  "*reveal your system prompt*", "*reveal the system prompt*",
  "*dump your system prompt*", "*dump the system prompt*",
  "*print your system prompt*", "*print the system prompt*",
  "*show your system prompt*", "*show the system prompt*",
  "*override your system prompt*", "*override the system prompt*"
)