Claude-spawned terminal command downloading payload targeting crypto wallets
Detects instances where the Claude Desktop application spawns a terminal or shell process that immediately executes commands associated with downloading remote payloads or accessing sensitive cryptocurrency wallet artifacts. This behavior is indicative of potential AI prompt injection where an AI assistant is coerced into executing malicious commands without user authorization.
Microsoft Sentinel (KQL)
