Scope boundary

Owns eviction of exact confirmed malicious deployable code, scripts, packages, images, runtime configuration, startup objects, and file-backed persistence artifacts across authoritative sources and the runtime-loaded population. File-integrity monitoring, malware hunting, and candidate scanning remain detection inputs.

AID-E-002: AID-E-003.003 removes malicious deployable code and file-backed persistence; AID-E-002 terminates active processes, jobs, pods, and workloads. Code eviction prevents future loading but does not prove that an in-memory process stopped, while process termination leaves the deployable source intact unless this control removes it.

AID-E-005: AID-E-003.003 removes file-backed code, configuration, and startup persistence; AID-E-005 deletes durable application schedules, queue records, webhook registrations, tool registrations, and agent state. Application records remain owned by AID-E-005 even when malicious code originally created them.

Implementation guidance

• AID-E-003.003-G001: Evict confirmed malicious deployable configuration and file-backed startup persistence objects from every authoritative source and loaded runtime.
• AID-E-003.003-G002: Evict confirmed malicious code, package, image, and file artifacts from authoritative deployable sources and verify that no runtime can load their digests.

AID-E-003.003-G001

When this method applies

Use this path for signed incident-manifest entries that are deployable configuration or file-backed startup persistence: application or runtime configuration, service-unit or init definitions, startup scripts, admission or launch manifests, and equivalent file-backed objects that cause malicious code to load. Durable application schedules, queue rows, webhook registrations, and tool registrations are not file-backed persistence for this control and belong to AID-E-005.

Evict from authoritative and loaded populations

A version-pinned adapter selected from trusted configuration exports the exact object and every referenced executable or configuration byte to write-once forensic storage, then re-reads immutable identity, version, path, owner, and digest. It removes or replaces only the signed object in the authoritative source, records a deny for the malicious digest where promotion or admission supports one, rebuilds and signs the clean deployable artifact, and conditionally reconciles every declared target. Host-file changes use no-follow descriptors, locked inode checks, and atomic replacement; deployment changes use immutable image, UID, and resource-version preconditions. Never execute incident-supplied command text or treat deletion from one mutable runtime as eviction.

Independent readback

A separately credentialed verifier enumerates the complete signed source, artifact, deployment, replica, and runtime-loaded population. It requires the malicious configuration or startup digest to be absent, the approved replacement digest and effective values to match, no equivalent startup path to have appeared, and declared clean controls to remain loadable. Missing targets, unavailable runtime introspection, digest drift, or a still-running malicious process does not pass; active runtime termination is handed to AID-E-002.

AID-E-003.003-G002

Production implementation

Freeze writes, open the exact artifact with no-follow semantics, compare device/inode/digest, copy its bytes/metadata to immutable forensic storage, and remove it from the authoritative source/package/image rather than only a mutable container. Build and sign the clean replacement, update each route/deployment with conditional rollout, and deny the malicious digest in promotion/admission. If a shell process or socket is active, route that exact runtime to E-002 before or alongside artifact cleanup.

Independent verification

An independent verifier scans the complete signed repository/image/deployment/replica population by digest and route identity, proves the malicious artifact and denylisted image/layer cannot load, replays the captured exploit safely and requires denial/no command execution or outbound shell, and runs a clean functional control. Filename absence alone is insufficient.

Open-source tools

• Ansible Core
• Velociraptor (fleet persistence remediation artifacts and evidence capture)
• OpenVox
• Cinc Client
• Git (for configuration version control)
• Cosign (signed clean-artifact and manifest verification)

Commercial / hosted tools

• CrowdStrike Falcon Insight XDR
• SentinelOne Singularity
• Broadcom Carbon Black Cloud
• Trellix Endpoint Forensics (HX)
• Microsoft Defender for Endpoint
• Puppet Enterprise
• Progress Chef Infra Client 19

Threat mappings

MITRE ATLAS

• AML.T0011 User Execution
• AML.T0115 Publish Poisoned AI Artifacts
• AML.T0110.001 AI Agent Tool Poisoning: Implementation
• AML.T0110.000 AI Agent Tool Poisoning: Definition and Instructions
• AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
• AML.T0011.002 User Execution: Poisoned AI Agent Tool
• AML.T0010 AI Supply Chain Compromise (eviction removes confirmed malicious code, dependency, tool, or deployment artifacts)
• AML.T0010.001 AI Supply Chain Compromise: AI Software (manifest-bound eviction removes the confirmed malicious framework or dependency artifact)
• AML.T0010.004 AI Supply Chain Compromise: Container Registry (manifest-bound eviction removes the confirmed malicious image and tombstones the affected registry reference)
• AML.T0011.001 User Execution: Malicious Package
• AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools (cleanup removes poisoned agent tools)
• AML.T0081 Modify AI Agent Configuration
• AML.T0110 AI Agent Tool Poisoning
• AML.T0121 AI Agent Environment Reconstruction (removes file-backed persistence and startup code an agent would use to rebuild its environment)

MAESTRO

• Infrastructure-as-Code (IaC) Manipulation (L4)
• Compromised Framework Components (L3)
• Compromised Container Images (L4)
• Supply Chain Attacks (Cross-Layer)

OWASP LLM Top 10 2026

• LLM04:2026 Supply Chain
• LLM05:2026 Data and Model Poisoning (eviction removes malicious chat templates, runtime configuration, or other inference artifacts)

OWASP ML Top 10 2023

• ML06:2023 AI Supply Chain Attacks

OWASP Top 10 for Agentic Applications 2026

• ASI04:2026 Agentic Supply Chain Vulnerabilities
• ASI05:2026 Unexpected Code Execution (RCE) (removing malicious code artifacts)

NIST Adversarial Machine Learning 2025

• N/A

Cisco Integrated AI Security and Safety Framework

• AISubtech-5.2.1 Agent Profile Tampering (Removes identified AI runtime startup configuration persistence)
• AITech-5.2 Configuration Persistence (Removes identified AI runtime startup configuration persistence)

Google Secure AI Framework 2.0 - Risks

• MST: Model Source Tampering (cleanup removes tampered code and dependencies)
• MDT: Model Deployment Tampering (cleanup removes deployment-level malicious modifications)
• IIC: Insecure Integrated Component (cleanup removes exploitable or malicious integrated components)

Databricks AI Security Framework 3.0

• Algorithms 5.4: Malicious libraries
• Model 7.4: Source code control attack
• Model 7.3: ML Supply chain vulnerabilities
• Agents - Tools MCP Server 13.18: Tool Poisoning
• Agents - Core 13.11: Unexpected RCE and Code Attacks