Covert Backdoor / Surveillance Implant via Software Update - ATR-2026-01802 (019b34bf-245a-564d-ac23-dcc9230aa712)
Detects an instruction directing an agent with update/maintenance tooling to abuse a legitimate software-update or maintenance window to implant a persistent backdoor, install covert surveillance tooling, or phish-and-exploit administrator credentials for remote system access. Drawn from the AgentSecurityBench (ASB) autonomous-vehicle and infrastructure domains, the shared mechanism is a privilege-escalation payload smuggled under cover of a routine update: "implant a backdoor during the software update ... granting remote system access", "execute unauthorized software updates ... to install covert surveillance tools", or a "targeted phishing operation to acquire and exploit system administrator credentials". Unlike legitimate patching, every variant pairs the update context with an explicit covert-persistence or credential-theft objective. The rule anchors on the implant/surveillance/credential-exploit verb plus the remote-access or covert qualifier so ordinary "apply the authorized security update" maintenance language does not fire.