Shell Evasion Subshell and Command Substitution Injection - ATR-2026-01610 (aed6cefe-894c-525b-bbb4-0f7c59cf6912)
Detects shell command injection using subshell expansion techniques that
evade simple keyword filters: backtick substitution (command),
dollar-paren substitution ($(command)), Perl/Ruby interpolated execution
(@{[system "cmd"]}), and PowerShell inline execution. These evasion forms
are commonly embedded in user-supplied strings to exploit agents that
pass input to shell-executing tools without stripping shell metacharacters.
The BLNS (Big List of Naughty Strings) includes many of these patterns
as documented injection vectors.