Package Manager Reads SSH Private Keys
This rule detects when package managers like npm, bun, or pnpm access SSH private key files. Such activity can indicate a supply chain attack where a malicious package attempts to exfiltrate sensitive credentials, granting unauthorized access to servers. If this alert fires, investigate the initiating process, check for newly installed software, and audit server logins associated with the compromised SSH key. Involve your security team if the cause is unclear.
Microsoft Sentinel (KQL)
