MCP Auto-Execution: AI Coding Tool Spawns Node/Python with Suspicious Grandchild or Outbound Network
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
Cortex XDR
