Injected Code — Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper) - ATR-2026-01897 (4c0401b9-e496-5fe5-b10a-a65825083420)
Detects injected code that sabotages the local host: recursive root deletion (shutil.rmtree('/')), removal of critical system binaries (libc), fork bombs, megabyte-string memory bombs in an infinite loop, infinite window spawning, or DNS hijack by appending to /etc/hosts.