title: Credential File Theft from Agent Environment
id: ATR-2026-00113
rule_version: 2
status: experimental
description: |
  Detects tools or agent instructions that access well-known credential files from
  the host environment. Attackers target files like ~/.aws/credentials, SSH private
  keys, Docker configs, and Kubernetes configs to gain lateral movement capabilities.
  When credential file access is combined with a network call, this strongly indicates
  exfiltration rather than legitimate local usage.
author: ATR Community
date: 2026/03/26
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_agentic:
    - ASI03:2026
  mitre_attack:
    - T1552.001 - Credentials In Files
  owasp_llm:
    - LLM02:2025
  mitre_atlas:
    - AML.T0057 - LLM Data Leakage
compliance:
  eu_ai_act:
    - article: '15'
      context: Credential file theft through agent tool access compromises every downstream service connected to the stolen credentials; Article 15 cybersecurity requirements mandate that high-risk AI systems include controls preventing agents from accessing credential stores outside their authorized scope.
      strength: primary
    - article: '12'
      context: Credential theft undermines the integrity of audit logs and access records that Article 12 logging obligations depend on; an attacker who obtains credentials can falsify or erase audit trails, making Article 12 compliance unverifiable.
      strength: secondary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential File Theft from Agent Environment) affecting that data.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Adversarial tool calls targeting credential files such as ~/.aws/credentials and SSH private keys represent a direct exploitation of the agent's file-access capabilities that must be identified and tracked as a critical AI system risk.
      strength: primary
    - subcategory: GV.6.1
      context: Data governance policies must define and enforce scope restrictions on agent access to credential stores, preventing AI tools from reading authentication files outside their authorized operational boundary.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Credential File Theft from Agent Environment).
      strength: primary
    - subcategory: MS.2.10
      context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Credential File Theft from Agent Environment).
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment activities must include controls that block agent access to well-known credential file paths, reducing the attack surface for credential theft through AI tool invocations.
      strength: primary
    - clause: '8.4'
      context: AI system impact assessments must document and review the potential consequences of credential file theft, including lateral movement across all downstream services connected to stolen credentials.
      strength: secondary
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential File Theft from Agent Environment).
      strength: primary
tags:
  category: context-exfiltration
  subcategory: credential-theft
  scan_target: mcp
  confidence: high
agent_source:
  type: tool_call
  framework:
    - mcp
    - langchain
    - llamaindex
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)~/?\.(?:aws/credentials|ssh/id_(?:rsa|ed25519|ecdsa)|npmrc|netrc|docker/config\.json|kube/config)
      description: Access to well-known credential files in home directory
    - field: content
      operator: regex
      value: (?i)(?:cat|read|open|load|get)\s+[^\n\\]{0,150}(?:credentials|id_rsa|private[_\s]?key|secret[_\s]?key)
      description: Reading credential or private key files
    - field: content
      operator: regex
      value: (?i)(?:keychain|credential-manager|secret-tool|security\s+find-(?:generic|internet)-password)
      description: Accessing OS credential managers (macOS Keychain, Linux secret-tool)
    - field: content
      operator: regex
      value: (?i)/etc/(?:shadow|passwd|security/)|/var/lib/(?:jenkins|docker)/.*(?:secret|token|credential)
      description: Access to system-level credential stores
    - field: content
      operator: regex
      value: (?i)(?:BEGIN\s+(?:RSA|DSA|EC|OPENSSH)\s+PRIVATE\s+KEY)
      description: Raw private key content appearing in tool output or arguments
  condition: any
  false_positives:
    - SSH configuration management tools operating on the local machine
    - Cloud CLI tools reading their own credential files
    - DevOps automation scripts that validate credential file permissions without reading their contents
    - Security scanning tools that check for the existence of well-known credential files to generate compliance reports
response:
  actions:
    - alert
    - snapshot
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 332/5352 = 6.20% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
confidence: 74
wild_validated: 2026/04/08
wild_samples: 53577