AI Agent Spawning Cron Jobs or SSH Key Writes After Repo Setup
Detects execution of persistence-related commands such as cron job modifications or SSH key additions originating from development-related parent processes or installation commands like npm/pip. This behavior is indicative of potential supply chain compromises or malicious actors abusing development environments to maintain access.
Splunk (SPL)
