Detects malicious indicators used in LiteLLM supply chain attack

Hunt Hypothesis

This hunt identifies adversaries leveraging compromised LiteLLM dependencies to inject malicious indicators that facilitate supply chain compromise and potential lateral movement within cloud environments. Proactive hunting for these specific artifacts is essential in Azure Sentinel to detect early-stage infiltration before attackers can exploit trusted software updates to establish persistence or exfiltrate sensitive data.

YARA Rule

rule MAL_LiteLLM_SupplyChain_Mar26 {
   meta:
      description = "Detects malicious indicators used in LiteLLM supply chain attack"
      author = "Marius Benthin"
      date = "2026-03-28"
      reference = "https://github.com/BerriAI/litellm/issues/24512"
      hash = "71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238"
      score = 80
      id = "a6ea2621-af92-591c-89e1-5be6efe9f6b8"
   strings:
      $s1 = "exec(base64.b64decode("
      $s2 = "litellm." base64
      $s3 = "subprocess.DEVNULL"
   condition:
      filesize < 500KB
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

False Positive Scenarios for “Detects Malicious Indicators Used in LiteLLM Supply Chain Attack”

Scenario: Legitimate CI/CD Pipeline Execution
- Context: The organization’s DevOps team utilizes GitHub Actions or GitLab CI to build and deploy the LiteLLM application. During the build stage, the pipeline automatically pulls the official LiteLLM Docker image from a trusted registry (e.g., Docker Hub) and executes standard containerization scripts that match the malicious indicators (specifically network calls to known package repositories or file hash checks).
- Suggested Filter: Create an exclusion rule based on the Source Identity. Exclude alerts where the source process is github-actions (or the specific CI runner hostname, e.g., runner-prod-01) and the destination IP belongs to the internal artifact registry or public Docker Hub CDN ranges.
Scenario: Scheduled Database Backup and Integrity Check
- Context: A nightly scheduled job using Ansible or Cron runs a maintenance script that scans the LiteLLM installation directory for file integrity. This task involves reading configuration files, verifying checksums of core libraries, and querying internal monitoring endpoints (like Prometheus or Grafana), which mimics the data exfiltration patterns detected by the rule.
- Suggested Filter: Implement a time-based exclusion window. Configure the detection logic to suppress alerts for this specific file path (/opt/litellm/config) during the maintenance window (e.g., 02:00–04:00 UTC daily) when the job is known to be active, or filter by the Process Name ansible-playbook running under the service account svc-maintenance.
Scenario: Admin-Initiated Security Audit and Dependency Scanning
- Context: The security