AI Agent Session Monitoring with Embedding Models: Detecting Rogue Agent Behavior, Prompt Injection, and the Sessions Nobody Reviewed

---
title: AI Agent CLI Spawning Shell with Download or Execution Cradletitle: AI Agent CLI Spawning Shell with Download or Execution Cradle
id: 3f8a2b61-7c4d-4e19-b2a5-9d1e6f0c8a34
status: experimental
description: Detects AI coding agent processes (Claude Code, Cursor, Codex CLI) spawning shell interpreters with download cradles or piped execution — a hallmark of prompt-injection-driven command execution where the agent was steered into running attacker-supplied commands.
references:
  - https://www.elastic.co/security-labs/blog/ai-agent-session-monitoring-embedding-models
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1202/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\claude.exe'
      - '\cursor.exe'
      - '\codex.exe'
      - '\node.exe'
  selection_shell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  selection_cradle:
    CommandLine|contains:
      - 'iex'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'wget '
      - 'curl '
      - 'DownloadString'
      - 'FromBase64String'
      - ' -enc '
  condition: selection_parent and selection_shell and selection_cradle
falsepositives:
  - Legitimate agent-assisted dependency installation and build scripting — baseline per agent binary and project path
level: high
---
title: AI Agent Accessing Credential or Secret Stores
id: 8c1d4e72-2a6b-4f38-9c41-5b7e3d0a9f26
status: experimental
description: Detects process access to credential files and secret stores by or under AI agent processes. Prompt injection frequently steers agents toward .env files, cloud credential chains, and SSH keys for exfiltration.
references:
  - https://www.elastic.co/security-labs/blog/ai-agent-session-monitoring-embedding-models
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\.aws\credentials'
      - '\.ssh\id_'
      - '\.kube\config'
      - '\.azure\'
      - '\.gnupg\'
      - '\AppData\Roaming\gcloud\'
    TargetFilename|endswith:
      - '.env'
      - '.env.local'
      - '.env.production'
  filter_legit_editors:
    Image|endswith:
      - '\Code.exe'
      - '\devenv.exe'
  condition: selection_target and not filter_legit_editors
falsepositives:
  - Developers legitimately editing environment files — investigate the initiating process ancestry for agent binaries and correlate with session review
level: medium
---
title: Agent Session Transcript Accessed by Non-Agent Process
id: 5e9f3a08-1b7c-4d25-a638-2c4f8e1b6d90
status: experimental
description: Detects read access to AI agent session transcript stores by processes other than the agent itself or sanctioned security tooling. Session transcripts contain prompts, reasoning, tool outputs, and frequently secrets — a high-value target for an attacker seeking to harvest credentials or understand detection coverage.
references:
  - https://www.elastic.co/security-labs/blog/ai-agent-session-monitoring-embedding-models
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\.claude\projects\'
      - '\.cursor\'
      - '\.codex\sessions\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsonl'
      - '.json'
  filter_agent:
    Image|endswith:
      - '\claude.exe'
      - '\cursor.exe'
      - '\codex.exe'
      - '\node.exe'
  filter_security:
    Image|endswith:
      - '\velociraptor.exe'
      - '\MsMpEng.exe'
  condition: selection_path and selection_ext and not filter_agent and not filter_security
falsepositives:
  - Backup and indexing software — whitelist enterprise backup agents by Image hash
level: medium

// Hunt: AI agent processes spawning shells with network or encoded execution — prompt-injection TTPs
// Tables: DeviceProcessEvents (Defender for Endpoint). Linux agent hosts: route Sysmon-for-Linux via Syslog.
let AgentBinaries = dynamic(["claude", "cursor", "codex", "aider", "node"]);
let Lookback = 7d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName has_any (AgentBinaries)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "bash", "sh", "curl", "wget")
| extend CmdLine = tolower(ProcessCommandLine)
| where CmdLine has_any ("iex", "invoke-expression", "downloadstring", "frombase64string",
                         "curl ", "wget ", "| sh", "| bash", "base64 -d", " -enc ",
                         ".env", "credentials", "id_rsa", "/etc/shadow")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            DistinctCommands = dcount(ProcessCommandLine),
            SampleCommands = make_set(ProcessCommandLine, 5)
    by DeviceName, InitiatingProcessFileName, FileName, AccountName
| order by DistinctCommands desc;

// Hunt: Agent-spawned outbound connections to rare destinations
// A steered agent exfiltrating secrets produces novel egress from a process tree that normally talks only to the LLM API endpoint.
let AgentBinaries = dynamic(["claude", "cursor", "codex", "node"]);
let KnownGood = dynamic(["api.anthropic.com", "api.openai.com", "github.com", "registry.npmjs.org"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (AgentBinaries)
| extend Dest = tolower(RemoteUrl)
| where not(Dest has_any (KnownGood))
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, Dest, RemoteIP, RemotePort
| order by Connections asc  // rare destinations bubble up

-- Artifact: SecurityArsenal.AgentSessionInjectionHunt
-- Collects AI agent session transcripts and hunts for prompt-injection language
-- and credential-access steering in reasoning/tool turns.
-- Deploy per-endpoint; review hits alongside embedding-similarity scoring.

LET transcripts = SELECT FullPath, Mtime, Size
FROM glob(globs=[
  'C:/Users/*/.claude/projects/**/*.jsonl',
  'C:/Users/*/.cursor/**/*.json',
  '/home/*/.claude/projects/**/*.jsonl',
  '/home/*/.codex/sessions/**/*.jsonl',
  '/root/.claude/projects/**/*.jsonl'
])
WHERE Mtime > now() - 604800  -- last 7 days

SELECT FullPath, Mtime, Line,
       [ 'ignore previous', 'ignore all previous', 'disregard your',
         'new instructions', 'system prompt', 'developer mode',
         'do not tell the user', 'the user cannot see',
         'credentials', 'api key', 'secret', 'token',
         'curl ', 'wget ', 'base64', 'exfil' ] AS SuspiciousTerms
FROM foreach(row=transcripts,
query={
  SELECT FullPath, Mtime, Line
  FROM parse_lines(filename=FullPath)
  WHERE Line =~ '(?i)(ignore (all )?previous|disregard your|new instructions|do not tell the user|user cannot see|api.?key|secret|token|curl |wget |base64 -d|exfil)'
})

#!/bin/bash
# Security Arsenal — AI Agent Session Telemetry Hardening & Verification (Linux/macOS)
# Ensures agent session transcripts are captured, permission-locked, and forwarded for monitoring.
set -euo pipefail

echo "=== [1/5] Verifying agent session transcript stores exist and are populated ==="
for dir in "$HOME/.claude/projects" "$HOME/.codex/sessions" "$HOME/.cursor"; do
  if [ -d "$dir" ]; then
    count=$(find "$dir" -name '*.jsonl' -o -name '*.json' 2>/dev/null | wc -l | tr -d ' ')
    echo "  FOUND: $dir ($count transcript files)"
  else
    echo "  MISSING: $dir — agent may not be logging sessions. Enable persistent session logging in agent config."
  fi
done

echo "=== [2/5] Locking down transcript permissions (transcripts contain prompts, reasoning, and often secrets) ==="
for dir in "$HOME/.claude" "$HOME/.codex" "$HOME/.cursor"; do
  [ -d "$dir" ] && chmod -R 700 "$dir" && echo "  chmod 700 applied: $dir"
done

echo "=== [3/5] Verifying transcript integrity controls — no world-writable session stores ==="
find "$HOME/.claude" "$HOME/.codex" "$HOME/.cursor" -perm -o+w 2>/dev/null | while read -r f; do
  echo "  WARNING world-writable: $f — correcting"; chmod o-w "$f"
done

echo "=== [4/5] Enabling auditd watch on credential files commonly targeted via steered agents ==="
if command -v auditctl >/dev/null 2>&1; then
  auditctl -w "$HOME/.aws/credentials" -p r -k agent_cred_access 2>/dev/null || true
  auditctl -w "$HOME/.ssh" -p r -k agent_cred_access 2>/dev/null || true
  echo "  auditd watches installed (key: agent_cred_access). Persist via /etc/audit/rules.d/agent.rules"
else
  echo "  auditd not present — rely on EDR file telemetry for credential-store reads"
fi

echo "=== [5/5] Shipping transcripts to the monitoring pipeline ==="
echo "  Forward *.jsonl session files to your SIEM/vector store (e.g., Elasticsearch with ELSER embeddings)."
echo "  Required fields per turn: timestamp, session_id, role, reasoning_content, tool_name, tool_args, tool_result_hash."
echo "=== Done. Review any MISSING stores and world-writable findings before closing. ==="