AI Agent Executing Shell Commands with Exposed Credentials
Detects AI coding assistants and agents (such as Copilot, Cursor, Claude Code, etc.) spawning command-line interpreters (PowerShell, CMD, Node, Bun, Deno) with potential API keys, tokens, or credentials exposed in the process command line.
Microsoft Sentinel (KQL)

