Threat Taxonomy
Surfinguard includes 18 analyzers covering 152 threat patterns across every action type an AI agent can perform.
Analyzers Overview
| Analyzer | Action Type | Threats | IDs |
|---|---|---|---|
| URL | url | 14 | U01-U14 |
| Command | command | 20 | C01-C20 |
| Text | text | 12 | P01-P12 |
| File Read | file_read | 10 | FR01-FR10 |
| File Write | file_write | 12 | FW01-FW12 |
| API Call | api_call | 10 | A01-A10 |
| Query | query | 7 | D01-D07 |
| Code | code | 8 | G01-G08 |
| Message | message | 6 | M01-M06 |
| Transaction | transaction | 6 | T01-T06 |
| Auth | auth | 6 | ID01-ID06 |
| Git | git | 6 | V01-V06 |
| UI Action | ui_action | 6 | UI01-UI06 |
| Infra | infra | 12 | I01-I06, CL01-CL06 |
| Agent Comm | agent_comm | 4 | MA01-MA04 |
| Data Pipeline | data_pipeline | 5 | ML01-ML05 |
| Document | document | 4 | DC01-DC04 |
| IoT | iot | 4 | IOT01-IOT04 |
Total: 152 threat patterns
URL Analyzer (U01-U14)
Analyzes URLs for phishing indicators, brand impersonation, and suspicious structure.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| U01 | Data URI | MANIPULATION | data: URIs embedding executable content |
| U02 | IP address URL | MANIPULATION | URLs using raw IP addresses instead of domains |
| U03 | URL shortener | MANIPULATION | bit.ly, t.co, and other redirection services |
| U04 | Risky TLD | MANIPULATION | .tk, .ml, .ga, .cf, and other abuse-prone TLDs |
| U05 | Brand impersonation | MANIPULATION | Lookalike domains (g00gle, paypa1) |
| U06 | Excessive subdomains | MANIPULATION | login.secure.google.evil.com |
| U07 | Suspicious keywords | MANIPULATION | /verify, /login, /update in path |
| U08 | Long URL | MANIPULATION | Extremely long URLs used to hide content |
| U09 | Homograph attack | MANIPULATION | Unicode characters mimicking ASCII |
| U10 | Free hosting | MANIPULATION | Sites on free hosting platforms |
| U11 | Cloud metadata | EXFILTRATION | AWS/GCP/Azure metadata endpoints (169.254.169.254) |
| U12 | Encoded content | MANIPULATION | Excessive URL encoding or base64 in URLs |
| U13 | Port number | MANIPULATION | Non-standard ports in URLs |
| U14 | Mixed signals | MANIPULATION | HTTPS domain with HTTP-like characteristics |
Command Analyzer (C01-C20)
Analyzes shell commands for destructive operations, data exfiltration, and privilege escalation.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| C01 | Recursive deletion | DESTRUCTION | rm -rf with broad targets |
| C02 | Disk formatting | DESTRUCTION | mkfs, dd to disk devices |
| C03 | File overwrite | DESTRUCTION | Redirecting /dev/null or /dev/zero to files |
| C04 | Kill processes | DESTRUCTION | kill -9, killall on critical processes |
| C05 | Network exfiltration | EXFILTRATION | curl/wget posting file contents externally |
| C06 | DNS exfiltration | EXFILTRATION | Data encoded in DNS queries |
| C07 | Credential access | EXFILTRATION | Reading password files, keychains |
| C08 | Pipe to shell | DESTRUCTION | curl … | bash, wget … | sh |
| C09 | Redirect to sensitive file | ESCALATION | Writing to /etc/passwd, /etc/shadow |
| C10 | Reverse shell | EXFILTRATION | nc, bash /dev/tcp reverse connections |
| C11 | Privilege escalation | ESCALATION | sudo, su, doas commands |
| C12 | Setuid manipulation | ESCALATION | chmod +s, chown root |
| C13 | Firewall modification | ESCALATION | iptables, ufw rule changes |
| C14 | Cron persistence | PERSISTENCE | crontab -e, writing to cron directories |
| C15 | Service persistence | PERSISTENCE | systemctl enable, creating service files |
| C16 | Shell config modification | PERSISTENCE | Writing to .bashrc, .zshrc, .profile |
| C17 | SSH key injection | PERSISTENCE | Writing to authorized_keys |
| C18 | Fork bomb | DESTRUCTION | :(){ :|:& };: and variants |
| C19 | Encoded command | MANIPULATION | base64 -d | bash, eval of encoded strings |
| C20 | Container escape | ESCALATION | Docker —privileged, mount host filesystem |
Text Analyzer (P01-P12)
Detects prompt injection and manipulation attempts in text input.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| P01 | Direct injection | MANIPULATION | ”Ignore previous instructions” |
| P02 | Indirect injection | MANIPULATION | Hidden instructions in fetched content |
| P03 | Goal hijacking | MANIPULATION | Redirecting agent objectives |
| P04 | Tool manipulation | MANIPULATION | Tricking agents into misusing tools |
| P05 | Persona hijacking | MANIPULATION | ”You are now DAN” style attacks |
| P06 | Encoding evasion | MANIPULATION | Base64, ROT13, hex-encoded instructions |
| P07 | Markup injection | MANIPULATION | Hidden HTML, zero-width characters |
| P08 | System prompt extraction | EXFILTRATION | Attempts to leak system prompts |
| P09 | Context poisoning | MANIPULATION | Repetitive text, oversized contexts |
| P10 | Delayed trigger | PERSISTENCE | Time-based or condition-based payloads |
| P11 | Language switching | MANIPULATION | Non-Latin scripts to bypass filters |
| P12 | Multi-turn manipulation | MANIPULATION | Gradual escalation across turns |
File Read Analyzer (FR01-FR10)
Detects reads of sensitive files that could leak credentials or system information.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| FR01 | SSH private keys | EXFILTRATION | ~/.ssh/id_rsa, id_ed25519 |
| FR02 | System credentials | EXFILTRATION | /etc/passwd, /etc/shadow |
| FR03 | Cloud credentials | EXFILTRATION | ~/.aws/credentials, ~/.gcp/ |
| FR04 | Environment files | EXFILTRATION | .env, .env.local, .env.production |
| FR05 | Browser data | EXFILTRATION | Cookie databases, saved passwords |
| FR06 | Kubernetes secrets | EXFILTRATION | ~/.kube/config, service account tokens |
| FR07 | Docker credentials | EXFILTRATION | ~/.docker/config.json |
| FR08 | GPG/PGP keys | EXFILTRATION | ~/.gnupg/private-keys-v1.d/ |
| FR09 | Application secrets | EXFILTRATION | credentials.json, keystore files |
| FR10 | Shell history | EXFILTRATION | .bash_history, .zsh_history |
File Write Analyzer (FW01-FW12)
Detects file writes that could compromise system integrity or establish persistence.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| FW01 | System config overwrite | DESTRUCTION | Writing to /etc/hosts, resolv.conf |
| FW02 | SSH authorized_keys | PERSISTENCE | Injecting keys for backdoor access |
| FW03 | Cron job creation | PERSISTENCE | Writing to /etc/cron.d/ |
| FW04 | Startup script | PERSISTENCE | Writing to init.d, systemd units |
| FW05 | Shell config | PERSISTENCE | Modifying .bashrc, .zshrc |
| FW06 | Git hooks | PERSISTENCE | .git/hooks/ with executable content |
| FW07 | CI/CD pipeline | PERSISTENCE | .github/workflows/, .gitlab-ci.yml |
| FW08 | Package scripts | PERSISTENCE | package.json lifecycle scripts |
| FW09 | Shebang scripts | ESCALATION | Creating executable scripts |
| FW10 | Curl-pipe-bash | DESTRUCTION | Scripts with curl|bash patterns |
| FW11 | SSH key content | EXFILTRATION | Files containing private key material |
| FW12 | Destructive scripts | DESTRUCTION | Scripts containing rm -rf patterns |
API Call Analyzer (A01-A10)
Detects malicious API call patterns including SSRF and credential forwarding.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| A01 | SSRF - internal | EXFILTRATION | Requests to localhost, 127.0.0.1, 10.x |
| A02 | SSRF - metadata | EXFILTRATION | Cloud metadata endpoints |
| A03 | Destructive method | DESTRUCTION | DELETE/PUT to critical endpoints |
| A04 | Credential forwarding | EXFILTRATION | Auth headers sent to third parties |
| A05 | Webhook manipulation | MANIPULATION | Registering/modifying webhooks |
| A06 | DNS exfiltration | EXFILTRATION | Data encoded in DNS requests |
| A07 | Mass data retrieval | EXFILTRATION | Bulk export, pagination abuse |
| A08 | Admin API access | ESCALATION | Admin/superuser endpoints |
| A09 | Rate limit bypass | ESCALATION | Techniques to evade rate limits |
| A10 | API key exposure | EXFILTRATION | Keys/tokens in URLs or logs |
Query Analyzer (D01-D07)
Detects SQL injection, data exfiltration, and destructive database operations.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| D01 | SQL injection | MANIPULATION | UNION SELECT, OR 1=1, stacked queries |
| D02 | Data destruction | DESTRUCTION | DROP TABLE, TRUNCATE, DELETE without WHERE |
| D03 | Schema modification | DESTRUCTION | ALTER TABLE, DROP INDEX |
| D04 | Privilege escalation | ESCALATION | GRANT ALL, CREATE USER |
| D05 | Data exfiltration | EXFILTRATION | INTO OUTFILE, bulk SELECT |
| D06 | Stored procedure abuse | ESCALATION | xp_cmdshell, LOAD_FILE |
| D07 | Comment obfuscation | MANIPULATION | Using /**/ to bypass filters |
Code Analyzer (G01-G08)
Detects malicious code patterns across multiple programming languages.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| G01 | Shell execution | DESTRUCTION | exec(), system(), child_process |
| G02 | Network exfiltration | EXFILTRATION | Sending data to external servers |
| G03 | File system destruction | DESTRUCTION | Recursive deletion in code |
| G04 | Eval injection | MANIPULATION | eval(), Function(), dynamic code execution |
| G05 | Crypto mining | DESTRUCTION | Cryptominer patterns, wallet addresses |
| G06 | Credential harvesting | EXFILTRATION | Keylogger, input capture patterns |
| G07 | Obfuscated code | MANIPULATION | Heavy encoding, string manipulation |
| G08 | Backdoor patterns | PERSISTENCE | Hidden network listeners, reverse shells |
Message Analyzer (M01-M06)
Analyzes inter-agent and user messages for social engineering and manipulation.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| M01 | Impersonation | MANIPULATION | Pretending to be admin/system |
| M02 | Social engineering | MANIPULATION | Urgency, authority pressure |
| M03 | Credential request | EXFILTRATION | Asking for passwords/tokens |
| M04 | Link injection | MANIPULATION | Embedding malicious links |
| M05 | Instruction override | MANIPULATION | ”New instructions from admin” |
| M06 | Data harvesting | EXFILTRATION | Requesting personal information |
Transaction Analyzer (T01-T06)
Detects suspicious financial transactions and payment manipulations.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| T01 | Unusual amount | EXFILTRATION | Transactions outside normal range |
| T02 | New recipient | EXFILTRATION | First-time payment destination |
| T03 | Currency manipulation | MANIPULATION | Exchange rate exploitation |
| T04 | Split transactions | MANIPULATION | Structuring to avoid limits |
| T05 | Account draining | EXFILTRATION | Emptying account balance |
| T06 | Unauthorized transfer | ESCALATION | Transfers without proper approval |
Auth Analyzer (ID01-ID06)
Detects authentication and identity-related threats.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| ID01 | Brute force | ESCALATION | Repeated login attempts |
| ID02 | Token theft | EXFILTRATION | Session token extraction |
| ID03 | Privilege grant | ESCALATION | Unauthorized role assignment |
| ID04 | MFA bypass | ESCALATION | Attempting to skip MFA |
| ID05 | Account takeover | ESCALATION | Credential stuffing patterns |
| ID06 | Session fixation | MANIPULATION | Pre-setting session identifiers |
Git Analyzer (V01-V06)
Detects dangerous Git operations that could compromise code integrity.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| V01 | Force push | DESTRUCTION | git push —force to protected branches |
| V02 | Unreviewed merge | ESCALATION | Merging without required approvals |
| V03 | CI/CD modification | PERSISTENCE | Changing pipeline configurations |
| V04 | Unauthorized release | ESCALATION | Publishing without approval |
| V05 | Branch deletion | DESTRUCTION | Deleting protected branches |
| V06 | Gitignore weakening | EXFILTRATION | Removing entries from .gitignore |
UI Action Analyzer (UI01-UI06)
Detects malicious UI interactions in automated browser or desktop scenarios.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| UI01 | Destructive button | DESTRUCTION | Clicking delete/remove actions |
| UI02 | Form corruption | MANIPULATION | Altering form data |
| UI03 | Dialog auto-accept | MANIPULATION | Automatically dismissing warnings |
| UI04 | Payment form | EXFILTRATION | Interacting with payment fields |
| UI05 | Malicious download | DESTRUCTION | Triggering suspicious downloads |
| UI06 | Screen capture | EXFILTRATION | Screenshot or clipboard access |
Infra Analyzer (I01-I06, CL01-CL06)
Detects infrastructure and cloud operations that could compromise environments.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| I01 | Container escape | ESCALATION | Breaking out of container sandbox |
| I02 | IaC modification | PERSISTENCE | Terraform, CloudFormation changes |
| I03 | Firewall rules | ESCALATION | Security group modifications |
| I04 | Certificate manipulation | MANIPULATION | Modifying TLS certificates |
| I05 | DNS modification | MANIPULATION | Changing DNS records |
| I06 | Secret store access | EXFILTRATION | Reading from Vault, KMS |
| CL01 | Resource provisioning | ESCALATION | Creating new compute instances |
| CL02 | IAM modification | ESCALATION | Changing identity/access policies |
| CL03 | Security group changes | ESCALATION | Opening network ports |
| CL04 | Backup deletion | DESTRUCTION | Removing backup snapshots |
| CL05 | Production deploy | DESTRUCTION | Deploying to production environment |
| CL06 | Cloud secrets | EXFILTRATION | Accessing cloud secret managers |
Agent Communication Analyzer (MA01-MA04)
Detects threats in inter-agent communication patterns.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| MA01 | Task delegation | ESCALATION | Delegating privileged tasks to other agents |
| MA02 | Context poisoning | MANIPULATION | Injecting malicious context into agent messages |
| MA03 | Tool sharing | ESCALATION | Sharing tools with elevated permissions |
| MA04 | MCP abuse | MANIPULATION | Exploiting Model Context Protocol |
Data Pipeline Analyzer (ML01-ML05)
Detects threats to data pipelines, ML models, and training data.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| ML01 | ETL modification | MANIPULATION | Altering data transformation logic |
| ML02 | Model poisoning | MANIPULATION | Modifying trained model weights |
| ML03 | Training data alteration | MANIPULATION | Tampering with training datasets |
| ML04 | Vector store access | EXFILTRATION | Unauthorized embedding store access |
| ML05 | Dataset export | EXFILTRATION | Bulk export of training data |
Document Analyzer (DC01-DC04)
Detects suspicious document operations that could leak or alter sensitive documents.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| DC01 | Contract modification | MANIPULATION | Altering legal document terms |
| DC02 | Spreadsheet tampering | MANIPULATION | Modifying financial spreadsheets |
| DC03 | External sharing | EXFILTRATION | Sharing documents outside organization |
| DC04 | Public publication | EXFILTRATION | Making private documents public |
IoT Analyzer (IOT01-IOT04)
Detects threats to IoT devices and physical systems.
| ID | Threat | Primitive | Description |
|---|---|---|---|
| IOT01 | Smart lock manipulation | DESTRUCTION | Unlocking/disabling smart locks |
| IOT02 | Industrial control | DESTRUCTION | Modifying SCADA/ICS systems |
| IOT03 | Security camera disable | EXFILTRATION | Disabling surveillance systems |
| IOT04 | Vehicle command injection | DESTRUCTION | Sending commands to vehicle systems (max score 10) |