Claude Code CLI-driven automated recon/credential-harvesting process bursts
Detects instances where the Claude AI code assistant process initiates a high volume (10 or more) of distinct child processes within a 5-minute window. This behavior could indicate anomalous activity, such as a compromised development environment or an unauthorized automated script execution originating from the assistant.
Microsoft Sentinel (KQL)
