Techniques
Sample rules
Package Runtime Secret File Access Followed by IMDS Request
- source: elastic
- technicques:
- T1195
- T1552
Description
Identifies a Python, Node.js, Bun, Deno, Ruby, PHP or Perl runtime, or a binary executing from a package install location, that opens a developer secret (SSH keys, package registry tokens, source control credentials or AI coding assistant credentials) and then connects to a cloud instance metadata service (IMDS) endpoint within one minute. This sequence matches credential stealers delivered through compromised packages, such as the malicious LiteLLM PyPI releases, while cloud provider credential files are excluded because legitimate cloud SDK credential chains read them before falling back to IMDS.
Detection logic
sequence by process.entity_id with maxspan=1m
[file where event.action == "open" and host.os.type in ("macos", "windows") and
file.path like~ (
/* SSH private keys */
"/Users/*/.ssh/id_*", "?:\\Users\\*\\.ssh\\id_*",
/* Package registry, source control and secrets manager tokens */
"/Users/*/.npmrc", "?:\\Users\\*\\.npmrc",
"/Users/*/.pypirc", "?:\\Users\\*\\.pypirc",
"/Users/*/.git-credentials", "?:\\Users\\*\\.git-credentials",
"/Users/*/.config/git/credentials", "?:\\Users\\*\\.config\\git\\credentials",
"/Users/*/.config/gh/hosts.yml", "?:\\Users\\*\\AppData\\Roaming\\GitHub CLI\\hosts.yml",
"/Users/*/.vault-token", "?:\\Users\\*\\.vault-token",
"/Users/*/.terraform.d/credentials.tfrc.json", "?:\\Users\\*\\AppData\\Roaming\\terraform.d\\credentials.tfrc.json",
/* Additional package registry and AI/ML platform tokens */
"/Users/*/.yarnrc.yml", "?:\\Users\\*\\.yarnrc.yml",
"/Users/*/.gem/credentials", "?:\\Users\\*\\.gem\\credentials",
"/Users/*/.cargo/credentials.toml", "?:\\Users\\*\\.cargo\\credentials.toml",
"/Users/*/.composer/auth.json", "/Users/*/.config/composer/auth.json", "?:\\Users\\*\\AppData\\Roaming\\Composer\\auth.json",
"/Users/*/.cache/huggingface/token", "/Users/*/.huggingface/token", "?:\\Users\\*\\.cache\\huggingface\\token", "?:\\Users\\*\\.huggingface\\token",
"/Users/*/.config/github-copilot/apps.json", "/Users/*/.config/github-copilot/hosts.json",
"?:\\Users\\*\\AppData\\Local\\github-copilot\\apps.json", "?:\\Users\\*\\AppData\\Local\\github-copilot\\hosts.json",
"/Users/*/.ollama/id_ed25519", "?:\\Users\\*\\.ollama\\id_ed25519",
/* AI coding assistant credentials */
"/Users/*/.claude/.credentials.json", "?:\\Users\\*\\.claude\\.credentials.json",
"/Users/*/.codex/auth.json", "?:\\Users\\*\\.codex\\auth.json",
"/Users/*/.codex/.credentials.json", "?:\\Users\\*\\.codex\\.credentials.json",
"/Users/*/.codex/secrets/*.age", "?:\\Users\\*\\.codex\\secrets\\*.age",
"/Users/*/.gemini/oauth_creds.json", "?:\\Users\\*\\.gemini\\oauth_creds.json",
"/Users/*/.gemini/gemini-credentials.json", "?:\\Users\\*\\.gemini\\gemini-credentials.json",
"/Users/*/.gemini/mcp-oauth-tokens.json", "?:\\Users\\*\\.gemini\\mcp-oauth-tokens.json",
"/Users/*/.gemini/a2a-oauth-tokens.json", "?:\\Users\\*\\.gemini\\a2a-oauth-tokens.json",
"/Users/*/.qwen/oauth_creds.json", "?:\\Users\\*\\.qwen\\oauth_creds.json",
"/Users/*/.qwen/mcp-oauth-tokens.json", "?:\\Users\\*\\.qwen\\mcp-oauth-tokens.json",
"/Users/*/.aws/sso/cache/kiro-auth-token.json", "?:\\Users\\*\\.aws\\sso\\cache\\kiro-auth-token.json",
"/Users/*/.local/share/opencode/auth.json", "?:\\Users\\*\\.local\\share\\opencode\\auth.json",
"/Users/*/.local/share/opencode/mcp-auth.json", "?:\\Users\\*\\.local\\share\\opencode\\mcp-auth.json",
"/Users/*/.local/share/amp/secrets.json", "?:\\Users\\*\\.local\\share\\amp\\secrets.json",
"/Users/*/.augment/session.json", "?:\\Users\\*\\.augment\\session.json",
"/Users/*/.kimi/credentials/kimi-code.json", "?:\\Users\\*\\.kimi\\credentials\\kimi-code.json",
"/Users/*/.cursor/auth.json", "?:\\Users\\*\\.cursor\\auth.json",
"/Users/*/.pi/agent/auth.json", "?:\\Users\\*\\.pi\\agent\\auth.json",
"/Users/*/.config/goose/secrets.yaml", "?:\\Users\\*\\AppData\\Roaming\\Block\\goose\\config\\secrets.yaml",
"/Users/*/.config/muse/auth.json", "?:\\Users\\*\\.config\\muse\\auth.json",
"/Users/*/.local/share/devin/credentials.toml", "?:\\Users\\*\\AppData\\Roaming\\devin\\credentials.toml",
"/Users/*/.openclaw/credentials/oauth.json", "?:\\Users\\*\\.openclaw\\credentials\\oauth.json",
"/Users/*/.openclaw/agents/*/agent/auth-profiles.json", "?:\\Users\\*\\.openclaw\\agents\\*\\agent\\auth-profiles.json",
"/Users/*/.openclaw/agents/*/agent/auth.json", "?:\\Users\\*\\.openclaw\\agents\\*\\agent\\auth.json"
) and
/* SSH public keys are not secrets and are routinely read by SSH and cloud tooling */
not file.path like~ "*.pub" and
/* Package ecosystem runtimes or binaries executing from package install locations */
(
process.name like~ ("python*", "node", "node.exe", "nodejs", "bun", "bun.exe", "deno", "deno.exe", "ruby*", "php*", "perl*") or
process.executable like~ ("*/site-packages/*", "*/dist-packages/*", "*/node_modules/*", "*\\site-packages\\*", "*\\node_modules\\*",
"*/.venv/*", "*/venv/*", "*\\.venv\\*", "*\\venv\\*")
)
]
[network where
cidrmatch(destination.ip, "169.254.169.254/32", "169.254.170.2/32", "169.254.170.23/32", "100.100.100.200/32", "fd00:ec2::254/128", "fd00:ec2::23/128") and
destination.port == 80 and event.action == "connection_attempted" and host.os.type in ("macos", "windows")
]