Agentic AI Pipeline Automated Package Manager Installation via pip/npm/yarn
Detects the use of package management tools (pip, npm, yarn) to install packages when initiated by common scripting interpreters or shells (python, cmd, powershell) in environments likely associated with CI/CD pipelines or automated workflows. The rule intentionally excludes jupyter and ipython interactive environments, suggesting it targets non-interactive or automated deployments.
Microsoft Sentinel (KQL)
