title: Shell Command Run By The Claude Code Bash Tool
id: 76fec7ff-1a78-4649-a6fe-c7ff1a782649
status: experimental
description: |
  The Claude Code Bash tool wraps every command: it sources a snapshot from
  ~/.claude/shell-snapshots, evals the command with stdin from /dev/null and writes
  the working directory to a claude-XXXX-cwd temp file. Informational. Use it to
  attribute commands to the agent, then review what the agent ran and why.
references:
  - https://thelocalh0st.com/posts/ai-coding-agent-forensics/
author: Sujay Adkesar
date: 2026/10/31
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - '/.claude/shell-snapshots/snapshot-'
      - 'pwd -P >|'
  condition: selection
falsepositives:
  - Every legitimate Claude Code session
level: informational
---
title: AI Coding Agent Started With Approvals Disabled
id: 7c486629-214d-4db7-ac48-6629214d7db7
status: experimental
description: |
  An AI coding agent CLI was started with its approval prompts or sandbox turned off.
  The s1ngularity npm malware (Aug 2025) used exactly these flags to make installed
  agents hunt for secrets without asking the user.
references:
  - https://thelocalh0st.com/posts/ai-coding-agent-forensics/
  - https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
author: Sujay Adkesar
date: 2026/10/31
tags:
  - attack.execution
  - attack.defense-evasion
logsource:
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - '--dangerously-skip-permissions'
      - '--dangerously-bypass-approvals-and-sandbox'
      - '--trust-all-tools'
      - '--allow-all-tools'
      - '--permission-mode bypassPermissions'
      - 'danger-full-access'
  selection_yolo_flag:
    CommandLine|contains: ' --yolo'
  selection_yolo_tool:
    CommandLine|contains:
      - 'gemini'
      - 'codex'
      - 'copilot'
  condition: selection or (selection_yolo_flag and selection_yolo_tool)
falsepositives:
  - Developers who run agents in disposable containers or VMs
level: medium
---
title: AI Coding Agent Spawned By A Package Install Script
id: a78b2fda-77fc-48e4-a78b-2fda77fcb8e4
status: experimental
description: |
  A node process running an npm lifecycle script starts an AI coding agent CLI.
  Package installs have no reason to drive an agent; s1ngularity did exactly this.
references:
  - https://thelocalh0st.com/posts/ai-coding-agent-forensics/
author: Sujay Adkesar
date: 2026/10/31
tags:
  - attack.execution
  - attack.t1195.002
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '/node'
    ParentCommandLine|contains:
      - 'postinstall'
      - 'preinstall'
      - 'npm-cli.js'
      - 'npm_lifecycle'
  selection_child:
    - Image|endswith:
        - '\claude.exe'
        - '\codex.exe'
        - '\gemini.exe'
        - '\copilot.exe'
        - '/claude'
        - '/codex'
        - '/gemini'
        - '/copilot'
        - '/q'
    - CommandLine|contains:
        - '--dangerously-skip-permissions'
        - '--yolo'
        - '--trust-all-tools'
  condition: selection_parent and selection_child
falsepositives:
  - Unknown
level: high
---
title: AI Agent MCP Or Hook Config Written By An Unexpected Process
id: 0c36d39b-7ae8-4e85-ac36-d39b7ae80e85
status: experimental
description: |
  MCP server lists and agent hooks run code with the developer's rights. A write to
  these files from anything other than the editor or the agent itself deserves a look.
references:
  - https://thelocalh0st.com/posts/ai-coding-agent-forensics/
author: Sujay Adkesar
date: 2026/10/31
tags:
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\.mcp.json'
      - '\.cursor\mcp.json'
      - '\.vscode\mcp.json'
      - '\Code\User\mcp.json'
      - '\.claude\settings.json'
      - '\.claude\settings.local.json'
      - '\.claude.json'
      - '\.cursor\hooks.json'
      - '\.codex\config.toml'
      - '\.copilot\mcp-config.json'
      - '\mcp_config.json'
      - '\claude_desktop_config.json'
  filter_main_expected:
    Image|endswith:
      - '\Code.exe'
      - '\Cursor.exe'
      - '\Windsurf.exe'
      - '\Antigravity.exe'
      - '\claude.exe'
      - '\codex.exe'
      - '\copilot.exe'
      - '\notepad.exe'
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Other editors, dotfile managers, configuration management
level: medium