IDE Zipping Wallets
Detects IDE processes creating ZIP archives in temporary directories, which can indicate exfiltration of cryptocurrency wallets. The rule specifically looks for 'Code.exe' (VS Code) or 'cursor.exe' creating '.zip' files in common temporary paths like 'AppData\Local\Temp' or '/tmp/'.
Microsoft Sentinel (KQL)
