Python Executing secret-tool for Keyring Theft

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•6

Detects Python scripts leveraging secret-tool or DBus on Linux to dump GNOME keyring passwords (UNK_DeadDrop). The rule specifically looks for the 'secret-tool' process being initiated by 'python' or 'python3'.