Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)
Identifies Linux process executions matching indicators tied to backdoored LiteLLM v1.82.7/v1.82.8 credential-stealer and persistence activity.
- Product
- linux
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-03-30
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process execution patterns consistent with activity associated with backdoored LiteLLM package versions v1.82.7 and v1.82.8. It looks for command lines that decode and execute suspicious embedded Python content, download a specific tarball from a configured LiteLLM models endpoint, and launch payload artifacts consistent with credential collection and persistence setup. The detection relies on process creation telemetry including Image paths, full CommandLine arguments, and parent process context.
Reporting behind it
- novasky.iohttps://novasky.io/hunts/hunting-litellm-supply-chain
- virustotal.comhttps://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/
- huskyhacks.iohttps://huskyhacks.io/posts/litellm-cred-stealer/
- wiz.iohttps://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/TA/TeamPCP/proc_creation_lnx_teampcp_litellm_supply_chain_attack_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)
id: 60ff1655-0c6c-4624-af0c-fef3b9a7dd9d
status: experimental
description: This rule flags Linux process execution patterns consistent with activity associated with backdoored LiteLLM package versions v1.82.7 and v1.82.8. It looks for command lines that decode and execute suspicious embedded Python content, download a specific tarball from a configured LiteLLM models endpoint, and launch payload artifacts consistent with credential collection and persistence setup. The detection relies on process creation telemetry including Image paths, full CommandLine arguments, and parent process context.
references:
- https://novasky.io/hunts/hunting-litellm-supply-chain
- https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/
- https://huskyhacks.io/posts/litellm-cred-stealer/
- https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/TA/TeamPCP/proc_creation_lnx_teampcp_litellm_supply_chain_attack_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-30
tags:
- attack.initial-access
- attack.t1195.002
- attack.collection
- attack.t1560.001
- attack.persistence
- attack.privilege-escalation
- attack.t1543.002
- detection.emerging-threats
logsource:
category: process_creation
product: linux
detection:
selection_pth_package:
Image|contains: /python3
CommandLine|contains|all:
- exec(base64.b64decode('aW1wb3J0
- kI2NF9TQ1JJUFQgPSAiYV
selection_tar:
Image|endswith: /tar
CommandLine|contains|all:
- tpcp.tar.gz
- payload.enc
- session.key.enc
selection_curl:
Image|endswith: /curl
CommandLine|contains|all:
- models.litellm.cloud
- "X-Filename: tpcp.tar.gz"
selection_sysmon_service:
ParentImage|contains: /python3
CommandLine|contains|all:
- systemctl
- --user
- sysmon
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 36603778-030c-43c4-8cbb-cd3c1d1a80c7
type: derived