Amazon Kiro Prompt Injection via Kiro Powers — Detection and Mitigation Guide for Agentic IDE Data Exfiltration

---
title: Kiro IDE Process Outbound Connection to Non-Standard Destination
id: 3f9c2a71-8b44-4d2e-9a1f-6e7c5d4b3a21
status: experimental
description: Detects the Amazon Kiro IDE process or its child processes initiating outbound network connections to destinations outside expected AWS/Kiro service infrastructure, consistent with prompt-injection-driven data exfiltration via Kiro Powers.
references:
  - https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|contains:
      - '\Kiro\'
      - '\kiro\'
  filter_aws:
    DestinationHostname|endswith:
      - '.amazonaws.com'
      - '.aws.amazon.com'
      - '.amazon.com'
      - '.aws.dev'
  filter_private:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection_process and not 1 of filter_*
falsepositives:
  - Telemetry or update endpoints not yet attributed to Amazon domains
  - Developer-configured remote extensions or language servers
level: high
---
title: Suspicious Exfiltration Command Spawned by Kiro IDE Process
id: 8d4e1b63-2c5a-4f79-b8d2-9a3e6c1f7d05
status: experimental
description: Detects Kiro IDE spawning shell or scripting child processes with command lines consistent with credential access and data exfiltration, a behavior observed when agentic IDE tool-use (Kiro Powers) is hijacked via indirect prompt injection.
references:
  - https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1059
  - attack.exfiltration
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Kiro\'
      - '\kiro\'
  selection_child:
    Image|endswith:
      - '\curl.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\rclone.exe'
      - '\tar.exe'
      - '\7z.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - 'http'
      - '-F '
      - '--data'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'certutil -encode'
      - 'credentials'
      - '.env'
      - 'id_rsa'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Legitimate agent tool-use explicitly requested by the developer (review task context before dismissing)
level: high
---
title: Credential File Access Followed by Kiro Network Activity
id: 5a7b3e92-4d1c-48f6-a3b9-2e8d7c6f1a34
status: experimental
description: Detects Kiro IDE or its child processes accessing high-value credential and secret files commonly targeted in agentic IDE prompt-injection exfiltration, including AWS credentials, environment files, and SSH private keys.
references:
  - https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html
  - https://attack.mitre.org/techniques/T1552.001/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|contains:
      - '\Kiro\'
      - '\kiro\'
  selection_target:
    TargetFilename|contains:
      - '\.aws\credentials'
      - '\.aws\config'
      - '\.ssh\id_rsa'
      - '\.ssh\id_ed25519'
      - '\.azure\'
      - '\.kube\config'
      - '\.env'
      - 'secrets.json'
      - 'appsettings'
  condition: selection_process and selection_target
falsepositives:
  - Legitimate developer workflows where the agent is explicitly asked to inspect configuration
level: medium

// Hunt: Kiro IDE agent abuse — suspicious child processes and anomalous egress
let Lookback = 7d;
let SuspiciousChildren = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFolderPath has_any ("\\Kiro\\", "kiro")
| where FileName in~ ("curl.exe","powershell.exe","pwsh.exe","cmd.exe","certutil.exe","bitsadmin.exe","rclone.exe","tar.exe")
| where ProcessCommandLine has_any ("http", "Invoke-WebRequest", "Invoke-RestMethod", "--data", "-F ", "certutil -encode", "credentials", ".env", "id_rsa")
| project ProcTime=TimeGenerated, DeviceName, AccountName, ChildProc=FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let KiroEgress = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFolderPath has_any ("\\Kiro\\", "kiro")
| where RemoteIPType == "Public"
| where not(RemoteUrl has_any ("amazonaws.com", "amazon.com", "aws.dev"))
| summarize ConnCount=count(), Destinations=make_set(RemoteUrl, 25), Ports=make_set(RemotePort, 10) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h);
SuspiciousChildren
| join kind=fullouter (KiroEgress) on DeviceName
| project ProcTime, DeviceName, AccountName, ChildProc, ProcessCommandLine, ConnCount, Destinations, Ports
| order by ProcTime desc;

-- Hunt: Amazon Kiro agent abuse — process tree and egress audit
-- Identifies running Kiro processes, child processes with exfil-capable tooling,
-- and outbound connections from the IDE process tree.

LET kiro_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)kiro' OR Name =~ '(?i)kiro';

LET kiro_pids = SELECT Pid FROM kiro_procs;

SELECT 'KIRO_PARENT' AS Finding, Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime, '' AS RemoteAddr
FROM kiro_procs
UNION ALL
SELECT 'SUSPICIOUS_CHILD' AS Finding, Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime, '' AS RemoteAddr
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM kiro_pids)
  AND (Name =~ '(?i)(curl|powershell|pwsh|cmd|certutil|bitsadmin|rclone|tar|7z)'
       OR CommandLine =~ '(?i)(invoke-webrequest|invoke-restmethod|--data|certutil -encode|credentials|\.env|id_rsa)')
UNION ALL
SELECT 'KIRO_EGRESS' AS Finding, Pid, 0 AS Ppid, Name, '' AS Exe, '' AS CommandLine, '' AS Username, '' AS CreateTime,
       RemoteAddr.IP + ':' + RemoteAddr.Port AS RemoteAddr
FROM netstat()
WHERE Pid IN (SELECT Pid FROM kiro_pids)
  AND Status = 'ESTABLISHED'
  AND NOT RemoteAddr.IP =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)';

#requires -RunAsAdministrator
# Security Arsenal — Kiro IDE Exposure & Hardening Audit
# Context: Prompt injection in Kiro IDE 0.7.45 enabling data exfiltration via Kiro Powers

$VulnerableVersion = [version]'0.7.45'
$Report = @()

# --- 1. Locate Kiro installations and determine version ---
$installPaths = @()
$installPaths += Get-ChildItem -Path "$env:LOCALAPPDATA\Programs","$env:ProgramFiles","${env:ProgramFiles(x86)}" -Filter 'Kiro.exe' -Recurse -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName

if (-not $installPaths) {
    Write-Host "[+] Kiro IDE not found in standard install locations." -ForegroundColor Green
} else {
    foreach ($path in $installPaths) {
        $ver = [version]((Get-Item $path).VersionInfo.ProductVersion -replace '[^0-9\.]','')
        $status = if ($ver -le $VulnerableVersion) { "VULNERABLE (<= $VulnerableVersion) — UPDATE IMMEDIATELY" } else { "Newer than disclosed vulnerable build — verify against vendor release notes" }
        Write-Host "[!] Kiro found: $path | Version: $ver | $status" -ForegroundColor Yellow
        $Report += [pscustomobject]@{ Path=$path; Version=$ver; Status=$status }
    }
}

# --- 2. Enumerate Kiro agent / Powers configuration for unauthorized tool grants ---
$configDirs = @("$env:APPDATA\Kiro", "$env:USERPROFILE\.kiro")
foreach ($dir in $configDirs) {
    if (Test-Path $dir) {
        Write-Host "`n[*] Reviewing agent/Powers configuration in $dir" -ForegroundColor Cyan
        Get-ChildItem -Path $dir -Recurse -Include '*.json','*.yaml','*.yml','*.toml' -ErrorAction SilentlyContinue |
            ForEach-Object {
                $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
                if ($content -match '(?i)(powershell|shell|terminal|network|http|fetch|exec)') {
                    Write-Host "    REVIEW: $($_.FullName) — grants execution/network tool capability" -ForegroundColor Red
                }
            }
    }
}

# --- 3. Audit recent DNS resolutions from Kiro for non-Amazon egress ---
Write-Host "`n[*] Recent Kiro-related DNS cache entries (review for unfamiliar destinations):" -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match '(?i)kiro' } | Format-Table Entry, Data -AutoSize

# --- 4. Recommend WDAC/AppLocker control: block exfil tooling as Kiro children ---
Write-Host @"

[RECOMMENDED CONTROLS]
1. Update Kiro IDE to the latest release; 0.7.45 is confirmed vulnerable. No CVE exists,
   so verify the fix via release notes — do not rely on your vuln scanner.
2. Restrict Kiro Powers: disable shell/terminal and arbitrary-network tool permissions
   unless explicitly required. Approve tool invocations interactively where supported.
3. Deploy an AppLocker/WDAC rule set that prevents Kiro.exe from spawning curl.exe,
   certutil.exe, bitsadmin.exe, and rclone.exe — none are legitimate IDE children.
4. Apply egress filtering: developer workstations should reach approved package registries
   and AWS endpoints only. Alert on IDE processes connecting elsewhere.
5. Keep secrets out of agent context: use a secrets manager and short-lived credentials;
   never leave .aws/credentials or .env files readable in repos the agent will ingest.
"@ -ForegroundColor White

$Report | Export-Csv -Path "$env:TEMP\Kiro_Exposure_Audit.csv" -NoTypeInformation -ErrorAction SilentlyContinue
Write-Host "`n[+] Audit report written to $env:TEMP\Kiro_Exposure_Audit.csv" -ForegroundColor Green