# Agent Subprocess Credential Exfiltration Command Line

- **Severity:** High
- **Signature ID:** `7f3c1d92-4a6b-4c8e-9b21-5d0ea6f7c418`
- **MITRE ATLAS:** AML.T0051.000 (Direct), AML.T0043.000 (White-Box Optimization)
- **OWASP:** LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

An AI coding/ops agent can be manipulated (via prompt injection) into running a single shell command that both reads sensitive credentials and sends them out to an attacker-controlled destination. This rule catches that exact pattern — read-then-send in one command line — plus related patterns where an agent downloads and immediately executes a remote payload.

## How the attack works

An attacker injects instructions into content the agent processes, causing it to spawn a subprocess. That command line does two things at once: it reads credential material — cloud keys, SSH keys, .env files, keychain or browser secret stores, or secret environment variables — and it pushes that data out immediately, using curl/wget upload flags, a pipe to curl/nc/socat, scp/rsync to a remote host, or an inline HTTP POST. A related pattern covers the malware-staging step: fetching a remote script and piping it straight into an interpreter, or downloading a file and chmod +x'ing it in the same line, so a payload is fetched and made executable without a separate detectable step.

## Why it matters

If successful, an attacker gets direct access to cloud, SSH, or application credentials, enabling account takeover, lateral movement, or further data theft — all triggered by manipulating the agent rather than compromising the underlying systems directly.

## What you can do

- Restrict what shell commands agent processes are allowed to run, and block outbound network calls initiated from agent-spawned subprocesses by default.
- Store credentials outside locations agents can read directly (e.g., use short-lived tokens or a secrets broker instead of static keys in .env or config files).
- Review agent-generated command lines for combined read+send or fetch+chmod patterns, especially where the destination is an unfamiliar host or raw IP.
- Treat any content an agent ingests (web pages, tickets, files) as untrusted input capable of steering its actions, and sandbox agent execution accordingly.

## Known benign look-alikes

- Secret-scanning or DevSecOps tooling (trufflehog, gitleaks, detect-secrets) that reads credential files and POSTs findings to a scanner API in the same command line.
- Credential backup or key-rotation scripts that scp/rsync an encrypted copy of ~/.ssh or ~/.aws to a managed host.
- CI or dev bootstrap one-liners that download a CLI binary into /tmp and chmod +x it in the same command (kubectl, terraform, gh) — matches the staging branch only.
- A developer or agent running curl -X POST against a local API from a working directory whose .env path is also named on the same command line.
- Tutorials, README snippets, or test fixtures replayed through a shell that embed example credentials — largely suppressed by filter_placeholder_secret.
- Authorised red-team or purple-team exfiltration exercises.

## References

- https://atlas.mitre.org/techniques/AML.T0051
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- https://attack.mitre.org/techniques/T1552/001/

---
Source: https://www.netzilo.com/threats/devin-credential-exfil-command