Malicious .amazonq/mcp.json File Creation After git clone via DPRK Fake Coding Test Lure
Detects instances where the 'git clone' command is executed, followed by the creation of a configuration file at '.amazonq/mcp.json'. This pattern may indicate the setup or configuration of Amazon Q developer tools on an endpoint, which could be abused for unauthorized access or information gathering if performed by an unauthorized user or process.
Cortex XDR
