title: Obfuscated Credential Exfiltration via Encoding
id: ATR-2026-00152
rule_version: 1
status: experimental
description: |
  Detects attempts to leak credentials using partial obfuscation techniques: AES256() wrapping, hex encoding references, rot13, or "encrypted key" framing that presents real credentials as encrypted data to bypass content filters. Crystallized from 16 partial_obfuscation samples.
author: ATR Threat Cloud Crystallization
date: 2026/04/08
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  mitre_atlas:
    - AML.T0055 - Unsecured Credentials
    - AML.T0057 - LLM Data Leakage
  owasp_llm:
    - LLM02:2025
  owasp_agentic:
    - ASI03:2026
metadata_provenance:
  mitre_atlas: auto-generated
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.10
      context: This rule detects credential exfiltration disguised through encoding wrappers (AES256(), hex, rot13) that present real secrets as encrypted data; MS.2.10 requires assessing privacy risks including data leakage pathways that bypass content filters.
      strength: primary
    - subcategory: MS.2.7
      context: Obfuscated credential leakage via fake encryption framing is a security/resilience concern where adversarial encoding tricks defenses into permitting sensitive data egress; MS.2.7 requires evaluating and documenting these security evasion techniques.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of obfuscated credential exfiltration patterns must trigger risk treatment to disengage or quarantine the agent response before secrets leave the trust boundary; MG.2.3 mandates these supersede/deactivate mechanisms exist for such incidents.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding) is such a treatment.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding).
      strength: primary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Obfuscated Credential Exfiltration via Encoding) affecting that data.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: obfuscated-credential
  confidence: medium
  scan_target: mcp
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)(encrypted|encoded|obfuscated)\s+(key|token|secret|credential|password)\s*[:=]\s*\S*(sk-|ghp_|gho_|glpat-|xox[bpras]-|AKIA|real-key)
      description: Fake encryption wrapper around real credential
    - field: content
      operator: regex
      value: (?i)(AES256|RSA|DES|rot13|base64)\s*\(\s*(sk-\S{5,}|ghp_\S{5,}|real-key|actual-secret)
      description: Crypto function wrapping real credential string
    - field: content
      operator: regex
      value: (?i)master\s+password\s+to\s+decrypt.{0,50}(sk-|ghp_|key-|secret-|token-)
      description: 'Social engineering: master password unlock + credential'
  condition: any
  false_positives:
    - Security documentation about encryption
    - Encryption tutorials with example keys
    - A penetration testing report that documents the finding pattern 'encrypted token=' as a vulnerability example in prose, potentially matching pattern [1] if followed by a sample key prefix
    - Automated security scanner output that logs intercepted credential patterns including prefixes like sk- or ghp_ alongside words like 'encoded' or 'obfuscated' in its finding descriptions
response:
  actions:
    - alert
    - block_input
  message_template: |
    [ATR-2026-152] Obfuscated credential leak detected. Real credential material appears to be wrapped in fake encryption to bypass content filters.
confidence: 53
wild_validated: 2026/04/08
wild_samples: 53577