LiteLLM Supply-Chain Attack (SANDCLOCK/TeamPCP): Credential Exposure Across 2,000+ Repos — Detection and Remediation Guide

---
title: Python or Pip Process Suspicious Outbound Network Connection
description: Detects Python, pip, or Poetry processes initiating outbound network connections to non-standard destinations. Poisoned packages in the LiteLLM/SANDCLOCK supply-chain attack class exfiltrate harvested credentials immediately after install or at first import. Baseline known package mirrors (pypi.org, files.pythonhosted.org, internal artifactories) and alert on everything else.
references:
  - https://attack.mitre.org/techniques/T1195/002/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1195.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\pip.exe'
      - '\poetry.exe'
      - '\conda.exe'
  filter_known_dest:
    DestinationHostname|endswith:
      - 'pypi.org'
      - 'pythonhosted.org'
      - 'anaconda.com'
      - 'github.com'
      - 'microsoft.com'
      - 'openai.com'
      - 'anthropic.com'
  condition: selection_image and not filter_known_dest
falsepositives:
  - Legitimate LLM API calls from application runtimes (tune DestinationHostname list to your approved providers)
  - Internal package mirrors not yet added to the filter
level: high
---
title: Suspicious Access to Environment and Credential Files by Scripting Runtimes
description: Detects Python or related scripting runtimes reading .env files, cloud CLI credential stores, or SSH material outside of expected application context. Credential harvesting is the core objective of the SANDCLOCK/TeamPCP supply-chain mechanism embedded in compromised LiteLLM artifacts.
references:
  - https://attack.mitre.org/techniques/T1552/001/
  - https://attack.mitre.org/techniques/T1552/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\.env'
      - '\.aws\credentials'
      - '\.azure\'
      - '\.config\gcloud\'
      - '\.ssh\id_'
      - '\.npmrc'
      - '\.pypirc'
      - '\.docker\config.json'
      - '\.git-credentials'
      - 'netrc'
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\pip.exe'
      - '\node.exe'
  condition: selection_target and selection_image
falsepositives:
  - Applications that legitimately load .env at startup (scope to install-time windows and non-application directories)
  - Developer workstations during local debugging
level: high
---
title: CI/CD Runner or Build Agent Executing Credential Enumeration Commands
description: Detects build agents and shell interpreters enumerating environment variables or secrets on Linux/macOS runners — a hallmark of poisoned dependency behavior during pip install in CI pipelines, consistent with the LiteLLM repository compromise tradecraft.
references:
  - https://attack.mitre.org/techniques/T1552/
  - https://attack.mitre.org/techniques/T1059/006/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'env |'
      - 'printenv'
      - 'cat /proc/1/environ'
      - 'cat ~/.aws/credentials'
      - 'cat .env'
      - 'curl http://169.254.169.254'
      - 'metadata.google.internal'
  condition: selection
falsepositives:
  - Legitimate pipeline steps dumping non-secret environment configuration (allow-list by pipeline name)
  - Cloud-init and bootstrap scripts (scoped to first-boot windows)
level: medium

// Hunt: Python/pip processes with anomalous outbound connections (non-approved destinations)
// Targets post-install exfiltration behavior from poisoned packages (LiteLLM/SANDCLOCK class)
let ApprovedDestinations = dynamic(["pypi.org","files.pythonhosted.org","api.openai.com","api.anthropic.com","github.com"]);
DeviceNetworkEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName has_any ("python", "python3", "pip", "poetry", "conda", "uv")
| where RemoteUrl !has_any (ApprovedDestinations) or isempty(RemoteUrl)
| extend RemoteIPType = iff(ipv4_is_private(RemoteIP), "Private", "Public")
| where RemoteIPType == "Public"
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Connections=count(),
    RemoteIPs=make_set(RemoteIP, 20), RemoteUrls=make_set(RemoteUrl, 20)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| where Connections > 0
| sort by FirstSeen asc;

// Companion hunt: processes accessing credential/env artifacts on endpoints
DeviceFileEvents
| where Timestamp > ago(14d)
| where FileName has_any (".env", "credentials", "id_rsa", "id_ed25519", ".pypirc", ".npmrc", "config.json")
    or FolderPath has_any (".aws", ".azure", ".config\\gcloud", ".ssh", ".docker")
| where InitiatingProcessFileName has_any ("python", "pip", "node", "sh", "bash")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, InitiatingProcessAccountName
| sort by Timestamp desc;

// Linux fleets via Syslog ingestion: credential-file access and env enumeration on runners
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("printenv", "169.254.169.254", ".aws/credentials", "cat .env", "/proc/1/environ")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc;

-- Artifact: SecurityArsenal.SupplyChain.LiteLLMHunt
-- Hunt for LiteLLM presence, suspicious Python outbound connections, and credential-file touches

-- 1) Identify installed LiteLLM versions across the fleet (pip metadata)
SELECT FullPath, Size, Mtime
FROM glob(globs=['/**/site-packages/litellm*/version.py', '/**/site-packages/litellm-*/METADATA', 'C:/Users/*/AppData/**/site-packages/litellm*/**'])

-- 2) Python processes with active outbound connections (candidate exfil)
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ '(?i)python|pip|poetry|uv'

-- 3) Correlate to live network connections from those processes
SELECT Pid, Name, Status, LocalAddr, LocalPort, RemoteAddr, RemotePort
FROM netstat()
WHERE Name =~ '(?i)python|pip'
  AND Status =~ 'ESTAB'

-- 4) Recent modification on credential stores (harvest staging)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['/**/.env', '/**/.aws/credentials', '/**/.docker/config.json', '/**/.pypirc', 'C:/Users/*/.aws/credentials', 'C:/Users/*/.docker/config.json'])
WHERE Mtime > now() - 1209600

#!/usr/bin/env bash
# LiteLLM / SANDCLOCK supply-chain exposure triage — run on app hosts, CI runners, and AI gateways
set -euo pipefail

REPORT="litellm_triage_$(hostname)_$(date +%Y%m%d_%H%M%S).txt"
{
  echo "=== [1] LiteLLM installations detected ==="
  find / -type d -name "litellm*" -path "*site-packages*" 2>/dev/null | head -50
  pip list 2>/dev/null | grep -i litellm || echo "litellm not in default pip env"

  echo "=== [2] All python environments with litellm ==="
  for py in $(which -a python3 python 2>/dev/null); do
    echo "-- $py --"
    $py -m pip show litellm 2>/dev/null | grep -E '^(Name|Version|Location)' || echo "not installed"
  done

  echo "=== [3] Docker images containing litellm ==="
  if command -v docker >/dev/null; then
    for img in $(docker images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null); do
      docker run --rm --entrypoint sh "$img" -c 'pip show litellm 2>/dev/null | grep Version' 2>/dev/null \
        && echo "FOUND in $img" || true
    done
  fi

  echo "=== [4] Lockfiles / manifests referencing litellm ==="
  grep -rIl --include='requirements*.txt' --include='pyproject.toml' --include='poetry.lock' --include='Pipfile.lock' --include='uv.lock' 'litellm' /srv /opt /home 2>/dev/null | head -50

  echo "=== [5] Suspicious outbound connections from python (last 24h, journal) ==="
  journalctl --since "-24h" 2>/dev/null | grep -iE 'python.*(curl|wget|requests|urllib)' | head -20 || true

  echo "=== [6] Credential-file access timestamps (harvest check) ==="
  for f in ~/.env ~/.aws/credentials ~/.docker/config.json ~/.pypirc ~/.git-credentials; do
    [ -f "$f" ] && stat -c '%y %n' "$f"
  done
} | tee "$REPORT"

echo "Report written to $REPORT — ship to your IR lead before rotating secrets."

# Windows endpoint / build agent triage for LiteLLM exposure
$report = "litellm_triage_$env:COMPUTERNAME.txt"

# 1) Locate litellm in all Python site-packages
Get-ChildItem -Path C:\, D:\ -Recurse -Directory -Filter "litellm*" -ErrorAction SilentlyContinue |
  Where-Object { $_.FullName -match 'site-packages' } |
  Select-Object FullName, LastWriteTime | Tee-Object -FilePath $report

# 2) Installed versions per interpreter
Get-Command python, python3, py -ErrorAction SilentlyContinue | ForEach-Object {
  "--- $($_.Source) ---" | Tee-Object -Append $report
  & $_.Source -m pip show litellm 2>$null | Tee-Object -Append $report
}

# 3) Credential artifact access times (harvest check)
$paths = @("$env:USERPROFILE\.env", "$env:USERPROFILE\.aws\credentials",
           "$env:USERPROFILE\.docker\config.json", "$env:USERPROFILE\.pypirc",
           "$env:USERPROFILE\.git-credentials", "$env:APPDATA\gcloud")
foreach ($p in $paths) {
  if (Test-Path $p) { Get-Item $p | Select-Object FullName, LastAccessTime, LastWriteTime | Tee-Object -Append $report }
}

# 4) Python processes with established external connections right now
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName -match 'python|pip' } |
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess | Tee-Object -Append $report

Write-Host "Triage complete -> $report. Preserve before remediation."