Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

title: Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)
id: 60ff1655-0c6c-4624-af0c-fef3b9a7dd9d
status: experimental
description: This rule flags Linux process execution patterns consistent with activity associated with backdoored LiteLLM package versions v1.82.7 and v1.82.8. It looks for command lines that decode and execute suspicious embedded Python content, download a specific tarball from a configured LiteLLM models endpoint, and launch payload artifacts consistent with credential collection and persistence setup. The detection relies on process creation telemetry including Image paths, full CommandLine arguments, and parent process context.
references:
  - https://novasky.io/hunts/hunting-litellm-supply-chain
  - https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/
  - https://huskyhacks.io/posts/litellm-cred-stealer/
  - https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/TA/TeamPCP/proc_creation_lnx_teampcp_litellm_supply_chain_attack_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-30
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.collection
  - attack.t1560.001
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection_pth_package:
    Image|contains: /python3
    CommandLine|contains|all:
      - exec(base64.b64decode('aW1wb3J0
      - kI2NF9TQ1JJUFQgPSAiYV
  selection_tar:
    Image|endswith: /tar
    CommandLine|contains|all:
      - tpcp.tar.gz
      - payload.enc
      - session.key.enc
  selection_curl:
    Image|endswith: /curl
    CommandLine|contains|all:
      - models.litellm.cloud
      - "X-Filename: tpcp.tar.gz"
  selection_sysmon_service:
    ParentImage|contains: /python3
    CommandLine|contains|all:
      - systemctl
      - --user
      - sysmon
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 36603778-030c-43c4-8cbb-cd3c1d1a80c7
    type: derived