Linux Process Creation Indicators of LiteLLM Supply-Chain Backdoor Activity (LiteLLM v1.82.7/v1.82.8)

title: Linux Process Creation Indicators of LiteLLM Supply-Chain Backdoor Activity (LiteLLM v1.82.7/v1.82.8)
id: 60ff1655-0c6c-4624-af0c-fef3b9a7dd9d
status: experimental
description: This rule flags Linux process executions that match specific command-line and artifact patterns associated with backdoored LiteLLM versions (v1.82.7 or v1.82.8). The behavior matters because the supplied indicators include steps consistent with credential harvesting, encrypted data handling, and persistence via a backdoor. Detection relies on process creation telemetry, including image paths and command-line arguments that reference the encoded Python loader, tarball payload naming, encrypted artifacts, and cloud/model fetching endpoints.
references:
  - https://novasky.io/hunts/hunting-litellm-supply-chain
  - https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/
  - https://huskyhacks.io/posts/litellm-cred-stealer/
  - https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/TA/TeamPCP/proc_creation_lnx_teampcp_litellm_supply_chain_attack_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-30
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.collection
  - attack.t1560.001
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection_pth_package:
    Image|contains: /python3
    CommandLine|contains|all:
      - exec(base64.b64decode('aW1wb3J0
      - kI2NF9TQ1JJUFQgPSAiYV
  selection_tar:
    Image|endswith: /tar
    CommandLine|contains|all:
      - tpcp.tar.gz
      - payload.enc
      - session.key.enc
  selection_curl:
    Image|endswith: /curl
    CommandLine|contains|all:
      - models.litellm.cloud
      - "X-Filename: tpcp.tar.gz"
  selection_sysmon_service:
    ParentImage|contains: /python3
    CommandLine|contains|all:
      - systemctl
      - --user
      - sysmon
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 36603778-030c-43c4-8cbb-cd3c1d1a80c7
    type: derived