Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Identifies Linux process executions matching indicators tied to backdoored LiteLLM v1.82.7/v1.82.8 credential-stealer and persistence activity.

FreeReviewedSigma · High · v5

Product: linux
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-03-30
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Collection

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
Persistence
- T1543.002Systemd Service
Priv Esc
- T1543.002Systemd Service
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule flags Linux process execution patterns consistent with activity associated with backdoored LiteLLM package versions v1.82.7 and v1.82.8. It looks for command lines that decode and execute suspicious embedded Python content, download a specific tarball from a configured LiteLLM models endpoint, and launch payload artifacts consistent with credential collection and persistence setup. The detection relies on process creation telemetry including Image paths, full CommandLine arguments, and parent process context.

Reporting behind it

Related detections9 linkedT1195.002 — drag to rearrange

Linux Persistence File Creation Targeting sysmon.py and systemd user service

Suspicious Child Process Spawned by Python Interpreter via Process Creation

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Suspicious TrueConf Update Chain Spawning Temporary Executable in Operation TrueChaos

Malicious Koske Persistence via Systemd Service and Shell Profile Hijack (via process_creation)

Suspicious Linux CoinMiner Watchdog Staging in Shared Memory (via process_creation)

Suspicious systemd Service Persistence Creation (via process_creation)

Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)

Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Pivot detection · T1195.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-creation-indicators-of-litellm-supply-chain-backdoor-activity-lite-36603778

title: Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)
id: 60ff1655-0c6c-4624-af0c-fef3b9a7dd9d
status: experimental
description: This rule flags Linux process execution patterns consistent with activity associated with backdoored LiteLLM package versions v1.82.7 and v1.82.8. It looks for command lines that decode and execute suspicious embedded Python content, download a specific tarball from a configured LiteLLM models endpoint, and launch payload artifacts consistent with credential collection and persistence setup. The detection relies on process creation telemetry including Image paths, full CommandLine arguments, and parent process context.
references:
  - https://novasky.io/hunts/hunting-litellm-supply-chain
  - https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/
  - https://huskyhacks.io/posts/litellm-cred-stealer/
  - https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/TA/TeamPCP/proc_creation_lnx_teampcp_litellm_supply_chain_attack_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-30
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.collection
  - attack.t1560.001
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection_pth_package:
    Image|contains: /python3
    CommandLine|contains|all:
      - exec(base64.b64decode('aW1wb3J0
      - kI2NF9TQ1JJUFQgPSAiYV
  selection_tar:
    Image|endswith: /tar
    CommandLine|contains|all:
      - tpcp.tar.gz
      - payload.enc
      - session.key.enc
  selection_curl:
    Image|endswith: /curl
    CommandLine|contains|all:
      - models.litellm.cloud
      - "X-Filename: tpcp.tar.gz"
  selection_sysmon_service:
    ParentImage|contains: /python3
    CommandLine|contains|all:
      - systemctl
      - --user
      - sysmon
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 36603778-030c-43c4-8cbb-cd3c1d1a80c7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL