Djinn Stealer AI Dev Tool Config Harvesting (MCP/Claude/Gemini/Codex)
Detects unauthorized processes reading, creating, or modifying sensitive files associated with local AI development tools and assistants (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). This rule monitors for file operations outside of the known, legitimate AI tool processes, suggesting potential credential theft or configuration tampering by malicious software.
Cortex XDR
