Public-Facing MCP/Agentic AI Server Spawning Command Shell (T1190)

Ibrahim Saud@tektrix

•updated 11 days ago•1•0•3

Detects instances where common scripting engines like Python or Node.js are used to spawn command shells (CMD, PowerShell, or Bash) followed by the execution of suspicious commands commonly associated with reconnaissance, file exfiltration, or lateral movement.