AI Coding Assistant Configuration File Creation by JS Runtimes
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by JavaScript runtimes (like node or bun). This activity may indicate a supply chain backdoor attempting to establish persistence within a project by modifying development environment configurations.
Microsoft Sentinel (KQL)
