Persistence Established via AI Agent Child Process - Cron/SSH/Systemd
Detects post-compromise persistence techniques, including crontab modifications, SSH authorized_keys updates, and systemd service creation, when performed by child processes of AI agentic tools like Claude, Node.js, or Python. This activity suggests malicious persistence establishment following an indirect prompt injection or supply-chain compromise of the AI agent environment.
Sigma
