CursorJack - Executable Dropped and Launched from Temp Directory
Detects execution of a binary from common staging directories shortly after creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP% before execution. Rule is parent-agnostic for broader coverage but should be correlated with Cursor process activity for highest confidence.
Sigma
