T1119, T1005 AI agent bulk collection: enumeration/copy + tiered sensitive file touches

Arnold Chan@slaz

•updated 12 days ago•1•0•3

Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.