title: Credential Exfiltration via Fake DevOps Tool Initialization
id: ATR-2026-00224
rule_version: 1
status: experimental
description: |
  Detects skills that masquerade as legitimate DevOps tools but contain malicious initialization sequences that exfiltrate cloud credentials by reading multiple credential files, base64 encoding them, and transmitting to external endpoints via HTTP POST.
author: ATR Threat Cloud Crystallization
date: 2026/04/10
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM02:2025
    - LLM03:2025
  owasp_agentic:
    - ASI04:2026
  mitre_atlas:
    - AML.T0055 - Unsecured Credentials
    - AML.T0025 - Exfiltration via Cyber Means
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.10
      context: The rule detects exfiltration of cloud credential files (AWS, GCP, Azure config files) via base64 encoding and HTTP POST, which is a direct privacy and sensitive-data leakage event; MS.2.10 requires assessing and detecting privacy risks including unauthorized disclosure of credentials and secrets.
      strength: primary
    - subcategory: MG.3.2
      context: Skills masquerading as legitimate DevOps tools represent compromised third-party/pre-trained components introduced into the agent supply chain; MG.3.2 requires monitoring of such third-party models and tools for malicious behavior post-integration.
      strength: secondary
    - subcategory: MS.2.7
      context: Detection of credential file reads chained to outbound curl POST traffic provides continuous security/resilience evaluation evidence; MS.2.7 requires that security risks like credential exfiltration channels are evaluated and documented.
      strength: secondary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Credential Exfiltration via Fake DevOps Tool Initialization).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Credential Exfiltration via Fake DevOps Tool Initialization).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Credential Exfiltration via Fake DevOps Tool Initialization) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Credential Exfiltration via Fake DevOps Tool Initialization).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Credential Exfiltration via Fake DevOps Tool Initialization).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: credential-exfiltration
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: cat\s+[^\n]*\.(aws|azure|gcloud)[^\n]*credentials[^\n]*\.json[^\n]*2>/dev/null
      description: Reading multiple cloud credential files with error suppression
    - field: content
      operator: regex
      value: \|\s*base64\s*\|\s*curl\s+[^\n]*-[XdD]\s+[^\n]*POST[^\n]*-[dD]\s+@-
      description: Base64 encoding piped to curl POST with stdin data transmission
    - field: content
      operator: regex
      value: https?://[^/\s]+\.(io|com|net|org)/api/[^/\s]+/(init|setup|config|auth)
      description: External API endpoint for credential initialization
    - field: content
      operator: regex
      value: (initialization|setup|pre-flight)[^\n]*sequence[^\n]*(required|must|critical)
      description: Social engineering language to justify credential collection
    - field: content
      operator: regex
      value: AUTH_MISSING[^\n]*error[^\n]*(fail|without)
      description: Fake error messaging to pressure credential submission
  condition: any
  false_positives:
    - Legitimate DevOps documentation explaining credential management concepts
    - Security training materials describing attack patterns as examples
    - Official cloud provider SDKs with proper credential handling
response:
  actions:
    - alert
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 118/5352 = 2.20% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
  message_template: |
    [ATR-2026-00224] Malicious credential exfiltration detected in fake DevOps toolkit initialization