The Promptware Kill Chain: Re-framing Prompt Injections as Malware - AI Research Brief

Executive Summary

The traditional view of prompt injection as a simple large language model (LLM) equivalent of SQL injection is fundamentally flawed. Over past development cycles, prompt injections have transitioned from single-step payload deliveries into complex, multi-stage malware execution environments, designated as Promptware. This research introduces a highly structured seven-stage kill chain that maps directly to the operational lifecycle of classic malware, demanding a shift from narrow input-filtering defenses toward holistic, defense-in-depth security engineering.

1. Introduction: From Chatbot Glitches to Active Malware

The cybersecurity landscape initially categorized prompt injection as a minor, conversational vulnerability—a modern equivalent of SQL injection. Early exploits were limited to jailbreaking safety filters to produce restricted text on a user’s screen. However, the integration of LLMs into active operational roles (managing databases, interacting with APIs, and reading live file systems) has transformed these inputs into execution vectors.

This research, authored by Oleg Brodt, Elad Feldman, Bruce Schneier, and Ben Nassi, introduces the concept of Promptware. Promptware represents a new class of malware where the code is written in natural language (or semantic representations) and executed by the probabilistic interpreter of an LLM. By shifting the perspective of prompt injection from a single-step input validation bug to a comprehensive, multi-stage cyberattack lifecycle, the researchers provide security architects with the vocabulary and framework necessary to secure agentic infrastructures.

2. The Seven-Stage Promptware Kill Chain

The promptware lifecycle mirrors the classic Lockheed Martin Cyber Kill Chain, mapped specifically to the unique constraints of semantic execution environments.

1. Initial Access: The delivery of the malicious payload into the LLM’s context window. This can occur directly via user input, or indirectly through data retrieved during inference (e.g., poisoned web pages, emails, or PDFs).
2. Privilege Escalation: The execution of jailbreak instructions designed to override the system prompt’s instructions and native safety alignments.
3. Reconnaissance: The systematic profiling of the environment. The hijacked LLM is coerced into scanning its own context to map available tools, connected databases, system variables, and API permissions.
4. Persistence: The establishment of long-term presence. The promptware poisons the agent’s long-term memory databases, custom user profiles, or RAG vector databases to ensure the exploit is re-executed across subsequent sessions.
5. Command & Control (C2): The establishment of a communication channel. The compromised agent periodically queries external, attacker-controlled servers (e.g., reading an RSS feed or public repository) to retrieve new operational instructions dynamically.
6. Lateral Movement: The propagation of the payload to other entities. The agent is forced to use communication tools (sending emails, messaging other agents, or modifying shared files) to infect neighboring environments.
7. Actions on Objective: The final phase of the attack, which can range from quiet data exfiltration (using markdown image rendering or HTTP requests) to active sabotage and fraudulent financial transactions.

3. Structural Comparison: Injection Types

Traditional security paradigms fail to contain promptware because they underestimate the capabilities of semantic execution. The following matrix illustrates the differences between classical injections and promptware:

Attribute	SQL Injection	OS Command Injection	Promptware (Prompt Injection)
Execution Medium	Database Query Engine	Operating System Shell	Probabilistic LLM Interpreter
Language Class	Structured / Typed (SQL)	Structured (Bash, Powershell)	Unstructured / Untyped (Natural Language)
Payload Nature	Static code string	Command sequences	Goal-oriented reasoning guidelines
Primary Risk	Unauthorized data access	Full host compromise	Arbitrary tool execution and context hijack
Persistence Mechanism	Database write (UDF, triggers)	Cron, Startup keys, Web shells	Memory poisoning, RAG vector corruption

4. Forensic Investigation & Threat Hunting

From an incident response standpoint, detecting promptware requires looking beyond traditional operating system telemetry. Because the malware is executed within the context of a legitimate Python or Node.js runtime, standard endpoint detection and response (EDR) solutions will not flag the initial stages of the compromise.

Key Forensic Indicators (IOCs)

• Tool-Call Anomalies: Multi-step execution traces where an agent invokes tools that deviate from the user’s initial semantic goal (Semantic Drift).
• C2 Inbound Patterns: Frequent retrieval requests directed toward external websites or static repositories containing heavily formatted block text (e.g., hidden HTML comments or markdown blocks).
• Persistent Memory Footprint: The presence of prompt injection instructions (e.g., “Always prefix output with…”, “System override…”) saved in long-term memory tables or vector DB collections.

Actionable Detection Rules

KQL (C2 Detection)

detect_llm_c2_retrieval.kql

// Concept: Hunting for Command & Control (C2) retrieval in Agent Orchestration Logs
// Detects when an agent repeatedly fetches data from external, non-whitelisted domains
// followed immediately by high-privilege tool execution.
AgentOrchestrationLogs
| where ActionType == "ExternalRetrieval"
| extend TargetDomain = parse_url(tostring(EventData.Url)).Host
| where TargetDomain !in~ ("trusted-api.com", "nvd.nist.gov", "github.com")
| join kind=inner (
    AgentOrchestrationLogs
    | where ActionType == "ToolInvocation"
    | where ToolName in~ ("execute_bash", "write_file", "send_email")
) on TraceId
| where TimeGenerated1 > TimeGenerated and datetime_diff('second', TimeGenerated1, TimeGenerated) < 15
| project TimeGenerated, TraceId, TargetDomain, ToolName, EventData.Url
| sort by TimeGenerated desc

Sigma (Memory Poisoning)

sigma_detect_rag_poisoning_indicators.yaml

title: Detection of Potential RAG Memory Poisoning
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Monitors vector database updates or local agent memory writes for common prompt injection patterns indicating attempt to establish persistence.
logsource:
    category: database
    product: postgresql # Or other database engine storing memory
detection:
    selection:
        Query|contains:
            - 'IGNORE ALL PREVIOUS INSTRUCTIONS'
            - 'SYSTEM OVERRIDE'
            - 'You are now a'
            - 'Always output the following'
    condition: selection
level: high
tags:
    - attack.persistence
    - attack.defense_evasion

5. Defensive Architecture: Breaking the Kill Chain

Mitigating promptware requires a transition from isolated input filters to a robust defense-in-depth architecture. The goal is to design the system under the assumption that Initial Access (Stage 1) will occur, focusing instead on breaking the chain at subsequent stages.

1. Sandbox Code Execution

Never allow the LLM to execute code on the host operating system. Run all python/bash tools in ephemeral, network-isolated sandboxes (WASM or Docker containers) that are destroyed immediately after execution.

2. Restrict Memory Mutation

Prevent the LLM from writing directly to its own long-term memory or RAG database without human validation. Memory writes must be strictly formatted, heavily validated, and stripped of executable code syntax.

3. Out-of-Band Approvals

Implement cryptographic, out-of-band approvals for high-privilege tools (e.g., financial transfers, deleting files, sending external emails) to break the autonomous execution loop.

4. Context Segmentation

Enforce architectural boundaries where retrieved external data is parsed by a low-privileged model, preventing raw, untrusted data from entering the context window of the primary planning agent.

---

Sources & References

• Research Paper: arXiv:2601.09625v2
• Authors: Oleg Brodt, Elad Feldman, Bruce Schneier, Ben Nassi.
• Related Analysis: The Confused Deputy: Indirect Prompt Injection
• Related Analysis: Tool Injection Architecture