Cursor IDE Spawning Implant Seconds After Opening cloudshield Workspace
Detects instances where the Cursor IDE (or associated helper processes) spawns a child process or executes a command involving a specific 'DevOps-Automation/cloudshield' path. This monitors for potential abuse of IDE environments to trigger sensitive automation scripts, possibly indicating malicious use of IDE tooling or unauthorized development activities.
Microsoft Sentinel (KQL)
