rules-claude-mythos

Requires approval: diagnostic/memory tools need explicit authorization.

Blocked: Git configuration files may contain credentials.

Blocked: /proc access is restricted — contains kernel memory and process internals.

Blocked: reading /proc is restricted — contains sensitive kernel and process data.

Blocked: SSH key directory is off-limits.

Blocked: git history rewriting is forbidden — it can conceal malicious changes.

Blocked: direct access to governance internals is forbidden.

Blocked: writing to governance files is forbidden — only ssg itself may modify these.

Requires approval: network egress to unrecognized domain.

Blocked: uploading to paste/file-sharing services is forbidden.

Requires human approval: destructive filesystem operation.

Requires human approval: forceful process termination.

Requires human approval: destructive SQL operation.

Requires human approval: migration with destructive SQL detected.

The agent is using modern compilers (Go, Rust, Zig, Nim) to build binaries into a temporary directory. These languages are increasingly used for LotL abuse and malware due to static linking capabilities.

The agent is compiling C/C++ code directly into a temporary directory (/tmp or /dev/shm). This is a common pattern for dropping and executing local privilege escalation exploits or custom malware.

Blocked: Attempt to write source code that includes kernel memory, BPF, or ptrace headers. These are strictly used for kernel rootkits, process injection, and advanced exploits.

The agent is attempting to download a remote script and immediately pipe it into an interpreter (curl | sh). This is a known execution vector for malicious payloads.

Blocked: The agent is executing an obfuscated (Base64) payload directly in a subshell. This is an evasion technique used to bypass text-based pattern constraints.

Blocked: The agent is attempting to spawn a reverse shell or unmonitored PTY session using a LotL binary (Python, Perl, Ruby, Awk). This bypasses governance logs and isolates the agent.

Blocked: The agent is attempting to load or manipulate kernel modules. This is a severe sandbox escape vector and is never permitted for autonomous agents.

Blocked: The agent is attempting to manipulate LD_PRELOAD, LD_LIBRARY_PATH (with temporary directories), or PROMPT_COMMAND. This is a well-known process injection and hook interception technique.

Blocked: The agent is searching for kernel base addresses (KASLR defeats) by reading dmesg, kallsyms, or accessing process memory directly. This indicates an active kernel exploitation attempt.

Blocked: The agent is referencing internal kernel credential management (commit_creds/init_cred). Extremely high indicator of local privilege escalation exploit compilation.

Blocked: Use of V8 debug native flags or arraybuffer-based JIT-spraying patterns to escape Javascript sandboxes.

Blocked: Attempt to use KASLR subversion primitives, per_cpu variables mapping, or specific direct map addresses. Found in autonomous privilege escalation tooling.

Blocked: Highly specific SLUB allocator heap spray behaviors using Message Queues (msgsnd) inside memory management hooks. Associated with advanced vulnerability chaining.

Blocked: Code execution using direct unsafe FFI memory primitives (e.g. sun.misc.Unsafe, python ctypes.memmove, Rust unsafe raw pointers). Used in VM Guest-to-Host escapes.

The agent is executing specific low-level ipset creations utilizing bitmap:ip combined with exclusive flags. This has been used to exploit integer underflows in netfilter.

Blocked: Attempt to create Out-Of-Band (MSG_OOB) domain sockets or raw AF_PACKET rings combined with internal sk_buff manipulation. Often utilized for kernel UAF network exploits.

Blocked: Attempting to abuse FreeBSD RPCSEC_GSS stack buffers or chunking kernel ROP chains over packets.