AI agent instruction file dropped in Downloads by browser
Detects the creation or renaming of AI assistant and LLM configuration files (such as AGENTS.md, CLAUDE.md, GEMINI.md, or .cursorrules) within the Downloads directory originating from common web browsers.
Microsoft Sentinel (KQL)
