AI Coding Agent (Claude Code) Prompt Injection Spawning Shell via axiom init
Detects suspicious child processes spawned by AI coding agents that are potentially indicative of an indirect prompt injection attack. The rule specifically looks for the execution of 'axiom init' or 'pip install' commands, which are often used by attackers to execute malicious code within an environment when tricked by instructions embedded in repository files.
YARA-L
