Amazon Q MCP Auto-Execution: amazonq-language-server Spawning Shell Processes
Detects instances where the Amazon Q language server or VS Code extension host spawns suspicious child processes, such as shells, interpreters (python, bash, powershell), or utilities commonly used to query or extract AWS cloud credentials.
Splunk (SPL)
