[[ fm.text ]] Click here

Likely infostealer access to AI agent authentication secrets

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects high-confidence access to AI agent authentication configuration files containing reusable gateway tokens by suspicious processes or by processes running from user-writable paths. AI-agent-specific filenames are used to reduce false positives from generic config.json or auth.json files found in every development environment.

title: Likely infostealer access to AI agent authentication secrets
id: 02b62c0a-0c3f-11f1-aa25-c7684f6249e0
status: experimental
description: |
  Detects high-confidence access to AI agent authentication configuration files containing reusable gateway tokens by suspicious processes or by processes running from user-writable paths. AI-agent-specific filenames are used to reduce false positives from generic config.json or auth.json files found in every development environment. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte avec un niveau de confiance élevé l’accès à des fichiers de configuration d’authentification d’un agent IA contenant des jetons réutilisables. L’accès seul ne confirme pas une exfiltration. Le SOC L1 doit vérifier le processus, l’utilisateur, le chemin, les noms de fichiers, le parent, la ligne de commande et toute activité réseau ou d’archivage.
related:
  - id: f1c4f294-0c3b-11f1-91a0-43ffe196cff2
    type: similar
  - id: f59de936-0c3e-11f1-97ae-9704b79e784d
    type: similar
  - id: a7b8c9d0-1e2f-3a4b-5c6d-7e8f9a0b1c2d
    type: similar

references:
  - https://www.infostealers.com/article/hudson-rock-identifies-real-world-infostealer-infection-targeting-openclaw-configurations/

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-02-16
modified: 2026-06-21

tags:
  - attack.credential-access
  - attack.t1552
  - attack.t1552.001
  - attack.t1555

logsource:
  category: file_event
  product: windows

detection:
  # AI-agent-specific auth files; avoids generic config.json/auth.json noise
  selection_auth_file:
    TargetFilename|endswith:
      - 'openclaw.json'
      - 'paired.json'
      - 'pending.json'
      - 'device-auth.json'
      - 'gateway-token.json'

  # Suspicious execution context: process image running from user-writable paths
  selection_suspicious_context:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\Temp\'
      - '\Downloads\'
      - '\Users\Public\'

  # Processes that should never read agent authentication files
  # SECOND CHALLENGE 2026-06-21: added certutil.exe and bitsadmin.exe (LOLBins used to exfiltrate
  # files via HTTP/FTP without spawning a shell), and msiexec.exe (used in some stager chains).
  selection_suspicious_process:
    Image|endswith:
      - '\svchost.exe'
      - '\rundll32.exe'
      - '\wmiprvse.exe'
      - '\dllhost.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\msiexec.exe'

  filter_legitimate:
    Image|endswith:
      - '\OpenClaw.exe'
      - '\python.exe'
      - '\node.exe'
      - '\pwsh.exe'
      - '\code.exe'

  condition: selection_auth_file and (selection_suspicious_context or selection_suspicious_process) and not filter_legitimate

fields:
  - TargetFilename
  - Image
  - ProcessId
  - User
  - Computer

falsepositives:
  - Developer scripts legitimately exporting config files for backup (allowlist by Image path)
  - Legitimate troubleshooting with a documented change ticket
  - Python or Node.js AI agent runtimes reading auth files at startup (filtered)

level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

df66782d-b3cf-4b42-bc67-97272f4aa6bd

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion