AI coding agent CLI launched from a user Downloads folder
Detects the execution of various AI coding assistant and CLI tools (such as Claude, Codex, Cursor, and Gemini) where the binary path or command line indicates execution from a Downloads folder, which is a common indicator of user-downloaded utilities running without proper installation.
Microsoft Sentinel (KQL)
