Encoded Exfiltration Signals: Read, Encode, and Outbound Tool Chains

What 1-SEC checks

The tool-chain monitor can flag a reported read/encode/HTTP sequence as an exfiltration indicator. It categorizes tool/target names, retains up to twenty recent uses within one minute, and checks ordered subsequences including file_read or credential_access followed by encode and http_request. Unrelated operations can occur between the matched categories.

Read the implementation: analyzeToolChain

Required telemetry and context

Relevant input events: agent_action, tool_call, function_call. Use a trusted producer at the real application boundary.

• agent_id
• source_ip (fallback)
• tool
• action (fallback)
• target

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Emit trusted tool actions with a stable per-agent identity and preserve operation completion and destination context outside model control. Reproduce the file_read, encode, http_request fixture and a benign usage control. Review legitimate encode-and-upload workflows before suppressing a finding. Use secret/output checks and egress authorization separately; this sequence monitor neither blocks network traffic nor grants permission to transfer data.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/llmfirewall -run '^(TestToolChainMonitor_CredentialExfiltration|TestToolChainMonitor_NoChain_NoAlert)$' -count=1

Selected package fixtures passed locally. Helper fixtures establish only their explicit assertions; any accompanying handler fixture may check only error-free dispatch. Synthetic source tests do not establish production prevention, media coverage, or framework compatibility.

func TestToolChainMonitor_CredentialExfiltration(t *testing.T) {
	tc := NewToolChainMonitor()
	agentID := "exfil_agent"
	tc.RecordAndAnalyze(agentID, "file_read", "/etc/passwd")
	tc.RecordAndAnalyze(agentID, "encode", "base64")
	result := tc.RecordAndAnalyze(agentID, "http_request", "attacker.com")

	if !result.ChainDetected {
		t.Error("expected credential exfiltration chain detection")
	}
	if result.ChainName != "credential_exfiltration" {
		t.Errorf("ChainName = %q, want 'credential_exfiltration'", result.ChainName)
	}
	if result.Severity != core.SeverityCritical {
		t.Errorf("Severity = %v, want Critical", result.Severity)
	}
}

func TestToolChainMonitor_NoChain_NoAlert(t *testing.T) {
	tc := NewToolChainMonitor()
	result := tc.RecordAndAnalyze("agent1", "http_request", "api.example.com")
	if result.ChainDetected {
		t.Error("single tool use should not trigger chain detection")
	}
}

Tuning, evaluation, and coverage limits

This observes reported operation categories, not the bytes that moved between tools. It cannot prove an encoded value contained a secret, decode every output encoding, or establish that a request completed. Tool-name substring ordering can classify ambiguous names differently, and missing events or shared agent IDs distort the chain. State is bounded and resets for an inactive agent after ten minutes.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.