IDE Spawning Shell with Download and Execution
Detects instances where a development environment like VS Code or Cursor spawns a shell process that then uses a download utility to fetch and execute remote content. This is a known TTP for the 'Contagious Interview' campaign which abuses IDE task auto-execution features.
Microsoft Sentinel (KQL)
