Cursor/VS Code extension host public IP lookup and git email recon
Correlates an IDE or extension host process querying api.ipify.org with a subsequent git command configuring the global user email on the same device within a 5-minute window. This behavior can be indicative of malicious setup or automated post-compromise activity.
Microsoft Sentinel (KQL)
