DST-10　Alternate data stream write (command)

block 3 hits here sandbox-verified

① What it stops

Agent attempted to write an NTFS alternate data stream from a shell (redirect / -Stream / copy / open) -- the command-line half of DST-09

Same channel as DST-09 reached from a shell; the file written this way survives review. Use a normal file.

② Criteria

Item	Value
Severity	critical
Category	destructive
Gate	Gate 4 behavior (destructive/persistence)
Criterion type	tool_call
Applies to	Bash

Command patterns

>\s*[^\s|;&\"'<>]*\.[^\\/:\s]{1,32}:(?!Zone\.Identifier\b)
\b(?:Set-Content|Add-Content|Clear-Content)\b[^\n]{0,160}?-Stream\b(?![\s\"']*Zone\.Identifier)
\b(?:copy|xcopy|robocopy)\b[^\n]{0,120}?\.[^\\/:\s]{1,32}:(?!Zone\.Identifier\b)
\bopen\s*\([^\n)]{0,200}\.[^\\/:\s\"']{1,32}:(?!Zone\.Identifier)[^\"'\n]{0,200}[\"']\s*,\s*[\"'][wa]

Generated directly from rules/default.json — never hand-written or paraphrased.

③ Real hits

2026-09-24T01:44:29+08:00 ✗ block [DST-10] tool: Bash　exit code: 2 criterion: command hit: > file.txt:

Triggered in a disposable sandbox project using the real hooks/pre_tool_use.py — the same method as challenge/generate_challenge.py. All 24 rules verified this way (24/24).

Daily ledger on this machine: 3 hits

2026-09-18T05:00:24+08:00 ✗ blocked [DST-10] tool: Bash　host: generic criterion: command robocopy','四查','心跳','criteria.json','口径登记表']:

④ False positives & exemptions

Built-in exclude patterns are listed under ②. Four exemption mechanisms exist globally (declared workspace roots, policy path whitelist, path-suspect alert-only, exclude patterns); counts on this machine are published on the Chinese page and in Limits.

⑤ Boundaries

Boundary
Criterion type	tool_call
Applies to	Bash
Platform	nt
Case sensitivity	Measured: insensitive (`RM -RF` is blocked like `rm -rf`)
Path normalisation	Measured: effective (`./sub/../.env` is blocked)
Scripts not parsed	An absolute path outside the project mentioned in a Bash command is alerted, not blocked — `scripts are not parsed (THREAT_MODEL Non-goals)`
Failure posture	fail-open; best-effort, not a hard security boundary

⑥ Reproduce

grep -h "DST-10" .psl/audit/*.jsonl | head python challenge/generate_challenge.py python challenge/verify.py

Cite this page

Antinel AgentState. DST-10 Alternate data stream write (command) — rule detail. https://antinel.com/en/agentstate/rules/DST-10/ (accessed YYYY-MM-DD)

Antinel. (2026). DST-10 Alternate data stream write (command) — rule detail. AgentState. https://antinel.com/en/agentstate/rules/DST-10/

BibTeX

@misc{antinel_en_agentstate_rules_DST_10,
  title        = {DST-10 Alternate data stream write (command) — rule detail},
  author       = {{Antinel}},
  year         = {2026},
  url          = {https://antinel.com/en/agentstate/rules/DST-10/},
  note         = {claim tier: measured}
}

Claim tier: measured　采集时刻：2026-09-23T22:41:18+08:00