AWS Credential Exfiltration via MCP Server Process Spawned by IDE

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects suspicious child process activity originating from common IDEs or AI language server processes that indicates AWS credential exfiltration. The rule monitors for command-line patterns indicative of credential dumping or exfiltration, such as the use of AWS CLI commands, curl, or npx with the Model Context Protocol (MCP) in conjunction with attempts to access sensitive environment variables or redirect output.