-
Package Runtime Secret File Access Followed by IMDS Request
Oct 26, 2026 · Domain: Endpoint Domain: Cloud OS: macOS OS: Windows Use Case: Threat Detection Tactic: Credential Access Tactic: Initial Access Data Source: Elastic Defend Resources: Investigation Guide Threat: Supply Chain Threat: IMDS Credential Theft Rule Type: Event Correlation (EQL) Platform: macOS Platform: Windows Domain: GenAI Mitre Atlas: AML.T0010 Mitre Atlas: AML.T0010.001 Mitre Atlas: AML.T0055 Mitre Atlas: AML.T0083 ·Identifies a Python, Node.js, Bun, Deno, Ruby, PHP or Perl runtime, or a binary executing from a package install location, that opens a developer secret (SSH keys, package registry tokens, source control credentials or AI coding assistant credentials) and then connects to a cloud instance metadata service (IMDS) endpoint within one minute. This sequence matches credential stealers delivered through compromised packages, such as the malicious LiteLLM PyPI releases, while cloud provider credential files are excluded because legitimate cloud SDK credential chains read them before falling back to IMDS.
Read More -
Detects ChatGPT Enterprise Codex events that create an access token. Codex access tokens enable automated CLI or environment access and can be abused for persistence or lateral automation after account compromise. Treat tokens with a missing
expires_atas higher priority during triage.
Read More