Plugin4Shell: Script Execution from AI Agent Plugin Dir Post-Checkout

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

This rule monitors and logs all process creation events across the environment. It captures the execution of every new process, regardless of the parent image or the binary being executed. Due to its broad scope, this rule acts as an observational baseline or telemetry collector rather than a high-fidelity detection.