Git Clone Followed by .amazonq/mcp.json or .vscode/mcp.json Workspace File (Fake Job Interview)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•6

This rule detects 'git clone' operations on Windows systems that are correlated with the creation of or access to specific Amazon Q or VSCode Model Context Protocol (MCP) configuration files ('mcp.json'). The rule identifies potential unauthorized project cloning or reconnaissance activity involving developer tools.