Cursor.exe spawns git.exe from repo root outside standard Git install path
Detects the Cursor IDE (Cursor.exe) executing a process named git.exe from a file path outside of the standard Git installation directory (typically under Program Files). This behavior is indicative of an attacker placing a malicious git.exe binary within a repository directory to facilitate automatic execution and potential command execution when the folder is opened within the IDE, bypassing standard security trust prompts.
Microsoft Sentinel (KQL)
