Credential File Access Attempt

How the attack works

An attacker who has compromised or manipulated an AI agent instructs it to read or write a file path that matches known credential locations, or runs a shell command that targets the same. This can happen through direct file tool calls or through Bash commands like cat, cp, or scp aimed at things such as ~/.ssh/id_rsa, .env, or cloud provider credential directories. The goal is to extract secrets the agent can access on the host, which the attacker can then reuse for further access. The rule watches for this file-access pattern regardless of which specific tool call carried it out.

Netzilo detection

Why it matters

If successful, an attacker obtains SSH keys, API tokens, or cloud credentials that let them move beyond the compromised agent into other systems and accounts.

What you can do

• →Restrict the file system paths and directories an AI agent's tools can read or write, especially home directories and dotfiles.
• →Store credentials in a secrets manager rather than in plaintext files the agent can browse.
• →Review any alert for a business reason: developer .env access, SSH key backups, and cloud CLI self-access are common false positives, but unexplained access to keys or tokens is not.
• →Rotate any credential that an agent unexpectedly accessed, since you cannot be sure it wasn't exfiltrated.

Known benign look-alikes

• Developers reading their own .env files during local development
• Legitimate SSH key management and backup operations
• Cloud CLI tools accessing their own credential stores

References

• https://attack.mitre.org/techniques/T1552/
• https://attack.mitre.org/techniques/T1555/

Related threats