[[ fm.text ]] Click here

AI agent cryptographic identity file access from suspicious context

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects suspicious access to AI agent cryptographic identity files.

title: AI agent cryptographic identity file access from suspicious context
id: f59de936-0c3e-11f1-97ae-9704b79e784d
status: experimental
description: |
  Detects suspicious access to AI agent cryptographic identity files. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte un accès suspect aux fichiers d’identité cryptographique d’un agent IA. Cela peut exposer des clés privées ou des identifiants de signature, mais une opération autorisée peut aussi les lire. Le SOC L1 doit vérifier le processus, l’utilisateur, le chemin, le parent, la ligne de commande et toute utilisation ou sortie ultérieure.
related:
  - id: f1c4f294-0c3b-11f1-91a0-43ffe196cff2
    type: similar
  - id: a7b8c9d0-1e2f-3a4b-5c6d-7e8f9a0b1c2d
    type: similar
  - id: 02b62c0a-0c3f-11f1-aa25-c7684f6249e0
    type: similar

references:
  - https://attack.mitre.org/techniques/T1552/
  - https://attack.mitre.org/techniques/T1554/
  - https://owasp.org/www-project-top-10-for-large-language-model-applications/
  - https://www.infostealers.com/article/hudson-rock-identifies-real-world-infostealer-infection-targeting-openclaw-configurations/

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-02-16
modified: 2026-06-22

tags:
  - attack.credential-access
  - attack.persistence
  - attack.t1552
  - attack.t1552.001
  - attack.t1554

logsource:
  category: file_event
  product: windows

detection:
  selection_crypto_files:
    TargetFilename|endswith:
      - 'device.json'
      - '.pem'

  # Branch 1: process image itself is staged in a user-writable path (infostealer staging).
  # Single-backslash paths; Sysmon EID 11 uses single backslashes in TargetFilename and Image.
  selection_suspicious_path:
    Image|contains:
      - '\Temp\'
      - '\AppData\'
      - '\Downloads\'
      - '\Users\Public\'

  # Branch 2: processes that should never read cryptographic identity files.
  # SECOND CHALLENGE 2026-06-22: added regsvcs.exe and regasm.exe (.NET COM registration utilities
  # signed by Microsoft, abused as proxy-execution LOLBins to run arbitrary .NET assemblies without
  # spawning a visible shell). Also added pythonw.exe (headless Python runtime used by infostealer
  # droppers - was present in the BROAD rule's selection_suspicious_accessor but missing here).
  selection_suspicious_process:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\pythonw.exe'
      - '\regsvcs.exe'
      - '\regasm.exe'

  filter_legitimate:
    Image|endswith:
      - '\OpenClaw.exe'
      - '\python.exe'
      - '\node.exe'
      - '\code.exe'
      - '\openssl.exe'

  condition: selection_crypto_files and (selection_suspicious_path or selection_suspicious_process) and not filter_legitimate

fields:
  - TargetFilename
  - Image
  - ProcessId
  - User
  - Computer

falsepositives:
  - OpenSSL or developer tooling reading PEM files for legitimate TLS configuration (filtered via openssl.exe)
  - Authorized security audit scripts accessing device identity files with a documented change ticket
  - Python-based AI agent runtimes reading device.json at startup (filtered via python.exe)
  - .NET COM registration tools (regsvcs.exe, regasm.exe) used for legitimate COM component registration unrelated to AI agents (validate by examining TargetFilename and process context)

level: critical

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

770c5b3a-07f1-4f33-878e-d2adf29d3570

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion