AI coding agent spawns shell or LOLBin to download and execute payload
Detects when AI coding agent processes (such as Claude, Cursor, Copilot, Windsurf, Codeium, or Aider) spawn command shells or download utilities with command lines indicative of downloading and executing external payloads.
Microsoft Sentinel (KQL)
