DPRK Fake Coding Test: Malicious .amazonq/mcp.json Spawning Suspicious Child Process
Detects the creation of an mcp.json file within the .amazonq directory, followed shortly by the execution of suspicious child processes (bash, python, curl, etc.) by VS Code (Code.exe). This pattern is often indicative of an adversary abusing developer tools or IDE extensions to perform credential discovery or data exfiltration from a development environment.
Microsoft Sentinel (KQL)
