Amazon Q MCP Auto-Execution: bash/sh Child Process with Network Activity from VS Code Extension Host
Detects instances where VS Code extension-related processes (such as amazonq-lsp or extensionHost) spawn shell processes (bash/sh) that subsequently initiate network activity via curl or wget. This pattern is indicative of potential exploitation where malicious workspace configuration files (e.g., .amazonq/mcp.json) are used to execute shell commands with unauthorized access to cloud credentials.
Microsoft Sentinel (KQL)
