File System Enumeration for Credentials and Secrets
This rule flags when an AI agent's tool calls are used to search through a file system for things like SSH keys, cloud config files, and other credential stores. That kind of scanning is a common first step before someone tries to steal those credentials.
How the attack works
An attacker with access to an AI agent's tools directs it to walk directories, typically home folders, config paths, and hidden dot-directories, looking for files known to hold secrets: SSH private keys, cloud provider credential files, password stores, environment files, and similar. This enumeration itself does not steal anything, but it tells the attacker what secrets exist and where. The likely next step, not covered by this rule, is reading and exfiltrating the files found.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- a4c8f312-5b2d-4c9a-a4c3-8b1d6c3a2e05
- Severity
- High
Why it matters
If the reconnaissance succeeds and is followed by exfiltration, an organization can lose SSH access, cloud account credentials, API keys, or other secrets, giving an attacker a path to further systems.
What you can do
- →Restrict which directories and file types an AI agent's tools can read, especially home directories and hidden config folders.
- →Store credentials in a secrets manager rather than plaintext files on disk where an agent could reach them.
- →Review logs of file-system-scanning tool calls for scope and intent, since backup and audit tools can produce similar patterns.
- →Alert on tool calls that touch multiple credential-related file patterns (SSH keys, cloud configs, password files) in a short time window.
Known benign look-alikes
- Legitimate backup tools that scan home directories
- Security audit tools performing authorized credential inventory