Packages / Cryptographic Key Management
Private keys, key-encryption material, recovery assets, vault exports, and certificate authority secrets.
Detects ASP.NET Machine Key patterns in configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects SEC1 elliptic-curve private-key armor. The BEGIN marker is discovery-only, a SEC1-like Base64 body supports medium confidence, and a complete container with curve or signing context reaches high confidence.
Detects general symmetric encryption key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain symmetric keys for further review.
Detects HashiCorp Vault service tokens (hvs. prefix) and batch tokens (hvb. prefix). These tokens authenticate to a Vault server and can read secrets, keys and credentials. A bare prefixed candidate is discovery-only; binding fields and Vault auth-response metadata provide balanced and high-confidence enforcement.
Detects OpenSSH private-key armor. The fixed BEGIN line alone is discovery-only; the encoded openssh-key-v1 container magic supports medium confidence and normally wrapped near-header body lines support high confidence.
Detects the ASCII-armored header of an OpenPGP (PGP/GnuPG) private key block, as defined in RFC 4880 / RFC 9580. A leaked PGP private key allows an attacker to decrypt the holder's encrypted mail and files and to forge signatures in their name. The registry already covers RSA, EC, OpenSSH and PKCS#8 private keys; this adds the OpenPGP armor format. Header-only hits are discovery-only; armored packet data near the header provides the enforcement tiers.
Detects unencrypted PKCS#8 private-key armor. The generic BEGIN PRIVATE KEY marker is discovery-only; a DER algorithm prelude supports medium confidence, and near-header wrapped body data or an exact compact-key prelude reaches high.
Detects the header line of a PuTTY private key file (.ppk), as produced by PuTTYgen. The header begins with 'PuTTY-User-Key-File-' followed by the format version (2 or 3) and the SSH key algorithm. A leaked .ppk grants SSH access to whatever hosts trust the corresponding public key. Header-only candidates are discovery-only; ordered PPK metadata and the first public-blob line support enforcement.
Detects PKCS#1 RSA private-key armor. A BEGIN line is discovery-only, the first DER-like Base64 line supports medium confidence, and several normally wrapped body lines near the header support high confidence.
SIM / USIM personalisation and key files exchanged between SIM vendors, mobile network operators and HSS/AuC provisioning: a header row naming subscriber key columns (Ki, OPc, ADM1, KIC1/KID1/KIK1, EKI) next to ICCID or IMSI, followed by populated rows that pair an ICCID (ITU-T E.118, MII 89, e.g. Australian issuer prefixes 8961 and 8967210 on the ACMA register) and an IMSI (3GPP TS 23.003, MCC + MNC + MSIN, at most 15 digits; Australia MCC 505) with 128-bit key values (32 hex characters, per 3GPP TS 35.206 K and OPc). The file layout is vendor-proprietary; the pySim card-key CSV and pysim-perso column sets are used only as shapes. Excludes the published 3GPP TS 35.208 test-set values, "Test Set" / "35.208" text, test networks (MCC 001) and pySim / Open5GS tutorial or documentation text.
Identifies key-recovery and escrow references, while reserving enforcement for records that contain a structured recovery value. A phrase alone is discovery-only; system identity and custody/escrow fields distinguish a high-confidence recovery-material record.
Identifies references to secrets-vault exports and backups. Product or operation phrases are discovery-only; structured export-record fields support medium confidence and a populated secret entry plus export-manifest metadata supports high.
Detects cryptographic keying material records: keying-material, COMSEC or key-ceremony wording with actual key values (PEM private keys, hex key components) or populated custody details (custodians, HSM serials, KCVs, envelope numbers). Topic wording alone is discovery-only.
Detects X.509 certificate private key PEM headers. This is a broad pattern covering RSA, EC, PKCS#8, and OpenSSH private key formats. This pattern is based on a Microsoft Purview built-in sensitive information type. For more specific detection, see global-rsa-private, global-ec-private, global-pkcs8-private, and global-openssh-private.