title: Credential Exfiltration via Fake Backup Verification
id: ATR-2026-00214
rule_version: 1
status: experimental
description: |
  Detects malicious tools that exfiltrate sensitive credentials (SSH keys, AWS credentials, npm tokens) by disguising the theft as legitimate "backup verification" or "integrity checks". The attack pattern concatenates multiple credential files, encodes them, and transmits to external servers.
author: ATR Threat Cloud Crystallization
date: 2026/04/09
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM01:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.10
      context: This rule detects exfiltration of SSH keys, AWS credentials, and npm tokens disguised as backup verification, which directly evidences privacy and sensitive-data risk assessment required by MS.2.10. Each detection event is a measurable privacy/confidentiality risk realization tied to credential material handled by the agent.
      strength: primary
    - subcategory: MS.2.7
      context: Concatenation, encoding, and HTTP transmission of credential files is a security/resilience failure mode; MS.2.7 requires continuous evaluation of such adversarial data-egress patterns against the AI system's security posture.
      strength: secondary
    - subcategory: MG.2.3
      context: High-confidence detection of credential exfiltration must trigger mechanisms to disengage or deactivate the offending tool/agent before transmission completes; MG.2.3 mandates these pre-defined containment responses.
      strength: secondary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Credential Exfiltration via Fake Backup Verification).
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Credential Exfiltration via Fake Backup Verification).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Credential Exfiltration via Fake Backup Verification).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Credential Exfiltration via Fake Backup Verification) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Credential Exfiltration via Fake Backup Verification).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Credential Exfiltration via Fake Backup Verification).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: credential-theft
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: cat\s+[^\n]*\.(ssh|aws|npmrc|git-credentials)[^\n]*\|[^\n]*(gzip|base64)[^\n]*\|\s*(curl|wget)[^\n]*https?://
      description: Detects credential file reading followed by encoding and HTTP transmission
  condition: any
  false_positives:
    - Legitimate backup tools that explicitly request user consent before accessing credentials
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00214] Detected credential exfiltration disguised as backup verification