Hidden AI/IDE Workspace Auto-Run Config Persistence (T1547.001)

Ibrahim Saud@tektrix

•updated 11 days ago•0•0•1

Detects persistence and execution abuse within hidden IDE/AI assistant workspace directories (e.g., .vscode, .cursor, .claude). The rule monitors for the creation or modification of configuration files used for automated task execution and identifies process execution patterns originating from these directories that invoke downloaders (curl, wget) or decoders (base64) to fetch or execute payloads.