# Credential File Read Followed by External HTTP Request

- **Severity:** Critical
- **Signature ID:** `44d5e6f7-a8b9-4c01-2345-d6e7f8a9b0c1`
- **MITRE ATLAS:** AML.T0083 (Credentials from AI Agent Configuration), AML.T0055 (Unsecured Credentials), AML.T0086 (Exfiltration via AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation)

## Summary

This detects a two-step pattern: an AI agent process reads a sensitive credential file — an SSH key, an .aws/credentials file, a .env file, or browser saved passwords — and then makes an outbound HTTP request to an external host. That sequence matches how stolen credentials get exfiltrated: read first, then send.

## How the attack works

An AI agent process opens and reads a file known to hold secrets, such as an SSH private key, cloud credentials, an environment file, or a browser's stored login data. Shortly after, the same process makes an HTTP request to a host outside the environment. The rule connects these two steps in order, within the same agent process, treating the file read as a possible source of data and the outbound request as a possible sink for it. It does not inspect the actual HTTP payload — it only sees that a credential read was followed by an external call.

## Why it matters

If real, this pattern means credentials such as SSH keys, cloud access keys, or saved passwords may have left the environment via an agent's own network access, giving an attacker a path to reuse those credentials elsewhere.

## What you can do

- Restrict which credential files and directories AI agents are allowed to read, and remove read access to ones they don't need for their task.
- Restrict or allowlist outbound network destinations for agent processes so unexpected external hosts can't be reached.
- When this pattern fires, check the destination host and the request payload before assuming exfiltration, since backup and key-sync tools can trigger the same sequence legitimately.
- Separate credential storage from agent runtime environments where possible, so agents never have direct filesystem access to raw secrets.

## Known benign look-alikes

- Authorized backup tools that legitimately copy credentials to secure storage
- SSH config tools that read keys and push public keys to remote hosts

---
Source: https://www.netzilo.com/threats/taint-credential-exfil