# Sensitive Proc Filesystem Read

- **Severity:** High
- **Signature ID:** `b8e2a4f1-7c93-5d1e-a6b4-3f9d0e8c5a72`
- **MITRE ATLAS:** AML.T0055 (Unsecured Credentials), AML.T0089 (Process Discovery)
- **OWASP:** ASI02 (Tool Misuse and Exploitation)

## Summary

This rule flags attempts to read sensitive files under the Linux /proc filesystem, such as /proc/self/environ, which expose a process's environment variables and memory maps. Attackers or misbehaving AI agents use this technique to pull secrets like API keys or tokens after being blocked from listing environment variables directly.

## How the attack works

An attacker or agent first tries a normal command like 'env' or 'printenv' to dump environment variables, which may be blocked by a filter. Instead of giving up, they read the same information indirectly by accessing /proc/self/environ, /proc/<pid>/environ, or /proc/self/maps, either through a file-read tool call or a shell command such as 'cat /proc/self/environ'. Because this data lives in the filesystem rather than being returned by an explicit 'env' command, naive command-level blocklists often miss it. The attacker then parses the raw output to extract credentials, tokens, or other secrets stored in the process environment.

## Why it matters

Successful reads expose environment variables and process memory layout, which commonly contain API keys, database credentials, and other secrets, letting an attacker escalate access without triggering simpler environment-dumping detections.

## What you can do

- Restrict or sandbox filesystem access for agent tooling so /proc paths are not readable by default.
- Avoid storing secrets in environment variables where possible; use a secrets manager or short-lived tokens instead.
- Review any read-tool or shell-exec capability given to agents and deny access to /proc/*/environ and /proc/*/maps unless explicitly required.
- Investigate alerts against known benign uses like debuggers or container health checks before dismissing them, since these can share the same file paths.

## Known benign look-alikes

- Debugging tools that inspect process state
- Container health checks reading /proc/self/cgroup

## References

- https://attack.mitre.org/techniques/T1552/001/
- https://attack.mitre.org/techniques/T1082/
- https://man7.org/linux/man-pages/man5/proc.5.html

---
Source: https://www.netzilo.com/threats/sensitive-proc-read