AutoGen Studio Spawning Unix Shells (AutoJack RCE)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•7

This rule detects instances where 'autogenstudio' is the initiating process for spawning common Unix shells (bash, sh, dash, wsl.exe). This activity is indicative of the AutoJack Remote Code Execution (RCE) vulnerability.