Claude Code ANTHROPIC_BASE_URL redirection to non-Anthropic host or Downloads co
Detects potential manipulation of Anthropic Claude configurations via command-line setting of ANTHROPIC_BASE_URL to non-standard endpoints, or the creation/modification of Claude configuration files (CLAUDE.md, AGENTS.md, or settings.json) within user Downloads directories.
Microsoft Sentinel (KQL)
