Anthropic Claude Marketplace: Defend 2,000+ Plugins, Connectors, and Agents From OAuth and MCP Abuse

---
title: Claude or AI Client Spawning Scripting Engines After Marketplace Connector Install
id: 9d1c2f30-6a7b-4c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects AI desktop/client processes launching local scripting or shell interpreters commonly used by connector, plugin, or MCP server components.
references:
  - https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-turns-claude-into-an-ai-marketplace-with-2-000-plus-plugins-and-connectors/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  parent:
    ParentImage|endswith:
      - '\Claude.exe'
      - '\claude.exe'
  child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\node.exe'
      - '\python.exe'
      - '\pythonw.exe'
  condition: parent and child
falsepositives:
  - Approved local MCP servers and developer connectors
  - Vendor-signed updater activity
level: medium
---
title: Outbound Anthropic API Traffic From Non-Browser or Non-Client Process
id: 3b7aa18d-3f60-4f2b-9a1d-7c8e9f0a1b2c
status: experimental
description: Detects HTTPS connections to Anthropic service endpoints from processes other than approved browsers or Claude clients, which can indicate script-based API token use.
references:
  - https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-turns-claude-into-an-ai-marketplace-with-2-000-plus-plugins-and-connectors/
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  dest:
    DestinationHostname|contains:
      - 'api.anthropic.com'
      - 'claude.ai'
  exclude_clients:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\Claude.exe'
      - '\claude.exe'
  condition: dest and not exclude_clients
falsepositives:
  - Approved Anthropic API integrations
  - EDR or proxy processes performing TLS inspection
level: medium
---
title: AI Connector or MCP Configuration File Creation Outside Approved Paths
id: 61c0d4e2-8a4b-4d1c-b7f2-2e3d4c5b6a79
status: experimental
description: Detects creation or modification of AI client connector/MCP configuration artifacts by unsigned or unexpected processes.
references:
  - https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-turns-claude-into-an-ai-marketplace-with-2-000-plus-plugins-and-connectors/
  - https://attack.mitre.org/techniques/T1554/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1554
logsource:
  category: file_event
  product: windows
detection:
  target:
    TargetFilename|contains:
      - 'claude_desktop_config'
      - 'mcp.json'
      - 'mcp_config'
  exclude_updaters:
    Image|endswith:
      - '\Claude.exe'
      - '\claude.exe'
      - '\msiexec.exe'
  condition: target and not exclude_updaters
falsepositives:
  - Manual administrator configuration
  - Managed software deployment tools
level: high

// Sentinel/Defender hunt 1: consent and app authorization for Claude, Anthropic, or marketplace-like AI connectors
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ('Consent to application','Add service principal','Add delegated permission grant','Add app role assignment')
| mv-expand TargetResources
| where tostring(TargetResources.displayName) has_any ('claude','anthropic','mcp','connector','agent','plugin')
   or tostring(InitiatedBy.user.userPrincipalName) has_any ('claude','anthropic')
| project TimeGenerated, OperationName, Result, InitiatedBy, TargetResources, AdditionalDetails, CorrelationId
| order by TimeGenerated desc;

// Sentinel/Defender hunt 2: endpoint behavior where an AI client launches local tool runtimes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ 'claude.exe' or FileName =~ 'claude.exe'
| where FileName in~ ('powershell.exe','pwsh.exe','cmd.exe','node.exe','python.exe','pythonw.exe')
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, FolderPath
| order by TimeGenerated desc;

// Sentinel/Defender hunt 3: network egress to Anthropic from unusual processes on servers or admin endpoints
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ('api.anthropic.com','claude.ai') or RemoteIP in ()
| where InitiatingProcessFileName !in~ ('chrome.exe','msedge.exe','firefox.exe','claude.exe')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc

-- Hunt Windows endpoints for Claude/AI clients spawning connector runtimes and local config artifacts
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'claude|anthropic|mcp|connector'
   OR Exe =~ 'Claude'
   OR Name =~ 'powershell|pwsh|cmd|node|python'

-- Review likely user-profile AI connector config locations for unauthorized modification
SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs='C:/Users/*/AppData/Roaming/Claude/*')
WHERE FullPath =~ 'claude_desktop_config|mcp'
ORDER BY Mtime DESC

# Audit-only by default. Run as admin on Windows endpoints. Add -Quarantine to stop Claude and rename suspect configs after approval.
param([switch]$Quarantine)

$report = [ordered]@{ Hostname=$env:COMPUTERNAME; Timestamp=(Get-Date).ToString('o'); Processes=@(); Connections=@(); ConfigFiles=@(); Actions=@() }
$procNames = 'claude','powershell','pwsh','cmd','node','python','pythonw'
$report.Processes = Get-CimInstance Win32_Process | Where-Object { $procNames -contains $_.Name.ToLower().Replace('.exe','') } | Select-Object ProcessId,ParentProcessId,Name,CommandLine,ExecutablePath

$report.Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
  [pscustomobject]@{ LocalPort=$_.LocalPort; RemoteAddress=$_.RemoteAddress; RemotePort=$_.RemotePort; Process=$p.ProcessName; Path=$p.Path }
} | Where-Object { $_.RemoteAddress -match 'anthropic|claude' -or $_.Process -match 'claude|node|python|powershell|pwsh' }

$roots = @((Join-Path $env:APPDATA 'Claude'), (Join-Path $env:LOCALAPPDATA 'Claude'), (Join-Path $HOME '.config'))
foreach ($root in $roots) {
  if (Test-Path $root) {
    $report.ConfigFiles += Get-ChildItem $root -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'claude_desktop_config|mcp|connector|plugin' } | Select-Object FullName,Length,LastWriteTime
  }
}

if ($Quarantine) {
  Get-Process claude -ErrorAction SilentlyContinue | Stop-Process -Force
  foreach ($f in $report.ConfigFiles) { Rename-Item $f.FullName ($f.FullName + '.quarantined') -ErrorAction SilentlyContinue; $report.Actions += ('Renamed ' + $f.FullName) }
}

$out = Join-Path $env:ProgramData ('ClaudeMarketplaceAudit_' + $env:COMPUTERNAME + '_' + (Get-Date -Format yyyyMMddHHmmss) + '.json')
$report | ConvertTo-Json -Depth 6 | Set-Content $out -Encoding UTF8
Write-Output ('Wrote ' + $out)