Agentic AI in Healthcare: Detecting Shadow IT Risks from Claude Code

---
title: Potential Agentic AI Tool Execution - Claude Code
id: 8a4b2c91-1f3e-4a5d-9b6c-3d4e5f6a7b8c
status: experimental
description: Detects the execution of known agentic AI coding assistants like Claude Code or similar binaries on endpoints. This indicates potential shadow development activity.
references:
  - https://www.healthcareitnews.com/news/ai-may-be-approaching-new-phase-healthcare-two-fronts
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'claude'
      - 'cursor'
      - 'aider'
    OriginalFileName|contains:
      - 'claude'
      - 'cursor'
  condition: selection
falsepositives:
  - Authorized developer usage (verify against user group)
level: medium
---
title: Scripting Engine Execution by Non-Engineering Users
id: 9c5d3e02-2g4f-5b6e-0c7d-4e5f6g7h8i9j
status: experimental
description: Detects execution of Python or Node.js scripts by users outside of Engineering/IT groups, a common indicator of physician-led AI development.
references:
  - https://www.healthcareitnews.com/news/ai-may-be-approaching-new-phase-healthcare-two-fronts
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_script:
    Image|endswith:
      - '\python.exe'
      - '\node.exe'
      - '\python3.exe'
  filter_engineering:
    Sid|contains:
      - 'S-1-5-21-...- Engineering Group SID' # Modify to match local SID structure
  condition: selection_script and not filter_engineering
falsepositives:
  - Data science teams using Python for legitimate analysis
level: low


**KQL (Microsoft Sentinel / Defender)**

// Hunt for suspicious AI agent command line usage
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has "claude" 
   or ProcessCommandLine has "anthropic"
   or ProcessCommandLine has "agentic"
| where InitiatingProcessAccountName !in ("Admin", "svc_devops")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for AI coding agent binaries and recent script execution
SELECT 
  Pid, 
  Name, 
  Exe, 
  CommandLine, 
  Username 
FROM pslist()
WHERE Name =~ "claude" 
   OR CommandLine =~ "claude" 
   OR Name =~ "Cursor"


**Remediation Script (PowerShell)**

# Audit and Restrict Unauthorized AI Development Tools
Write-Host "[+] Auditing for Agentic AI Tools..." -ForegroundColor Cyan

# Define risky tool names (add based on environment)
$riskTools = @("claude", "cursor", "aider", "copilot-cli")

# Check running processes
$foundProcesses = Get-Process | Where-Object { $riskTools -like "*$($_.ProcessName)*" }

if ($foundProcesses) {
    Write-Host "[!] ALERT: Agentic AI tools detected running:" -ForegroundColor Red
    $foundProcesses | Format-Table Id, ProcessName, Path -AutoSize
    
    # Optional: Kill process if policy dictates strict enforcement
    # $foundProcesses | Stop-Process -Force -WhatIf
} else {
    Write-Host "[-] No known AI agent processes running." -ForegroundColor Green
}

# Check common installation paths
$pathsToCheck = @("C:\Users\*\AppData\Local", "C:\Program Files")
foreach ($tool in $riskTools) {
    $installs = Get-ChildItem -Path $pathsToCheck -Filter "*$tool*" -Recurse -ErrorAction SilentlyContinue
    if ($installs) {
        Write-Host "[!] Found installation artifacts for $tool" -ForegroundColor Yellow
        $installs.FullName
    }
}