AI Agent Memory File Write Following Email-Processing Tool Call
Detects the creation of specific sensitive file names (AGENTS.md, MEMORY.md, IDENTITY.md, USER.md, SOUL.md) within 30 minutes of a process execution containing email-related keywords (email, mail, inbox). This pattern is often indicative of an adversary staging sensitive information for exfiltration after gaining access to or interacting with an email client or communication tool.
Cortex XDR
