AI Coding Agent Indirect Prompt Injection - Malicious Setup Script Execution
Detects AI coding agents (such as Claude Code, Cursor, Copilot CLI, etc.) spawning shell interpreters (bash, cmd, powershell) to execute installation or configuration scripts from within git-cloned repository directories. This activity is indicative of indirect prompt injection attacks where an adversary manipulates the agent into autonomously running malicious setup code.
Microsoft Sentinel (KQL)
