Claude MCP configuration theft by npm payload
This rule detects a malicious npm package attempting to read Claude MCP connection settings, which may contain sensitive information like API keys and server details. The theft of MCP configuration could allow attackers to impersonate AI integrations. If this rule triggers, the package should be removed, and any associated API keys should be rotated. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
Microsoft Sentinel (KQL)
