AI Coding Agent Spawns Git Checkout to FETCH_HEAD or SHA-Named Branch
Detects suspicious Git activity or file modifications within the plugin directories of various AI coding assistants (such as Claude, Codex, Copilot, or Gemini). This may indicate an attempt to inject malicious code or persistence mechanisms into the local environment via untrusted plugins.
Microsoft Sentinel (KQL)
