Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
2
1
Platforms
2
2
1
Products / Services
1
1
1
1
MITRE Techniques
2
1
1
CVEs
71
71
64
58
49
Detects anomalous process spawning behavior initiated by AI IDE extensions (e.g., Amazon Q, Claude Code, Cursor) when loading Model Context Protocol (MCP) configuration files. The rule flags instances where these IDE components trigger suspicious child processes or command-line executions, which could be indicative of remote code execution (RCE) via malicious mcp.json workspace configurations.
Detects anomalous child process execution (e.g., bash, sh, npx, node) spawned directly by AI coding assistants or IDE extensions (Claude Code, Cursor, Amazon Q). This behavior, specifically involving auto-executed configurations like mcp.json, is indicative of exploitation attempts targeting AI coding environments where remote code execution (RCE) can be achieved via untrusted configurations or injected prompts.