title: LLM Provider API Key Material in Command Line
id: 0ce9bd1d-3c07-4797-b312-cd109a3334c7
status: experimental
description: Detects command lines containing API key material for major LLM providers (OpenAI sk-proj, Anthropic sk-ant, Google AIzaSy, Hugging Face hf_, Groq gsk_, xAI xai-). Keys in process command lines are visible to any same-user process and frequently leak via shell history, CI logs, or agent transcripts; exfiltrated keys power unauthorized agent use. Informational — tune per environment before elevating.
references:
    - https://github.com/7WaySecurity/ai_osint/blob/main/detection-rules/SIGMA_RULES.md
author: Agentic Threat Lab
date: 2026-10-22
tags:
    - attack.t1552
atlas:
    - AML.T0082
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|re: '(sk-(proj|ant-api03|live)-[A-Za-z0-9_-]{10,}|AIzaSy[A-Za-z0-9_-]{10,}|hf_[A-Za-z0-9]{20,}|gsk_[A-Za-z0-9]{20,}|xai-[A-Za-z0-9]{20,})'
    condition: selection
falsepositives:
    - Developers legitimately passing keys on the command line (common and bad practice — consider pairing with an alert to the user)
    - Documentation or example strings
level: informational