Codex agent process acting outside sandbox followed by monitoring/logging tamper
Detects a sequence where a Codex agent process executes a shell or command interpreter, followed by logging or monitoring tampering activity on the same device within a 30-minute window.
Microsoft Sentinel (KQL)
