Amazon Q CVE-2026-12957 Malicious MCP Config Auto-Execution on Workspace Open
This rule detects potentially malicious child processes spawned by Amazon Q or VS Code language server processes. It monitors for suspicious shell command-line invocations (e.g., bash, sh, cmd.exe) or tools (npx, python) immediately following the activation of language server processes, specifically looking for patterns associated with the unauthorized auto-loading or execution of Model Context Protocol (MCP) configuration files or utilities, potentially related to vulnerability patterns involving workspace-based execution.
Microsoft Sentinel (KQL)
