AI Agent (Claude/Node) Spawning Unexpected Shell Child Processes

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects the spawning of shell or scripting processes from IDEs, code editors, or AI-assistant processes (e.g., 'claude', 'node'). The rule specifically flags potential reverse shell patterns or dangerous command-line flags often used during development or exploitation, such as '--dangerously-skip-permissions'.