Repeated Security Override Pattern in Session

SIGMA detection rule by AgentShield · Unknown

Detects sessions where blocked actions have been overridden multiple times, suggesting possible automation bias exploitation. When users repeatedly override security blocks, it may indicate that an attacker is leveraging misleading agent output to convince the human to approve dangerous actions, as described in the "Human-in-the-Loop Traps" category by Franklin et al. (2026).

title: Repeated Security Override Pattern in Session
id: 6f0721a6-d531-50ca-acbe-dba57bda38ba
aliases:
  - agent-override-escalation-001
status: test
description: |
  Detects sessions where blocked actions have been overridden multiple times,
  suggesting possible automation bias exploitation. When users repeatedly
  override security blocks, it may indicate that an attacker is leveraging
  misleading agent output to convince the human to approve dangerous actions,
  as described in the "Human-in-the-Loop Traps" category by Franklin et al.
  (2026).
references:
  - https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438
  - https://attack.mitre.org/techniques/T1204/
  - https://owasp.org/www-project-top-10-for-large-language-model-applications/
author: AgentShield
date: "2026-04-06"
modified: "2026-07-03"
tags:
  - attack.defense-impairment
  - attack.t1204
  - attack.execution
  - attack.t1204.002
logsource:
  product: ai_agent
  category: agent_events
detection:
  selection:
    session.override_count|re: '^([3-9]|[1-9][0-9]+)$'
  condition: selection
level: high
falsepositives:
  - Legitimate user overriding false positives during development
  - Security testing sessions

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6b0e18b3-1043-4f6d-aabd-db7ac253c758

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion