Cursor Pre-Trust Command Execution: Defend Developer Endpoints from Malicious Repositories

---
title: Cursor Editor Spawning Shell or Script Interpreter
description: Detects Cursor.exe spawning shells or script interpreters shortly after opening content, consistent with pre-trust workspace execution.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://www.infosecurity-magazine.com/news/cursor-security-bug-command/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Cursor.exe'
      - '\cursor.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\node.exe'
      - '\python.exe'
      - '\python3.exe'
      - '\npm.cmd'
      - '\npx.cmd'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build tasks, language servers, debuggers, and npm scripts in trusted repositories
level: high
---
title: Suspicious Workspace Metadata or Hook Execution
description: Detects process launches referencing repo-local editor metadata, package hooks, or bootstrap scripts that may run when a workspace is opened.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.supply_chain_compromise
logsource:
  category: process_creation
  product: windows
detection:
  selection_meta:
    CommandLine|contains:
      - '\.vscode\tasks.json'
      - '\.vscode\launch.json'
      - '\.cursor\'
      - 'preinstall'
      - 'postinstall'
      - 'prepare'
      - 'npm run'
      - 'npx '
      - 'pnpm '
      - 'yarn '
      - 'python -m'
      - 'node -e'
  selection_parent:
    ParentImage|endswith:
      - '\Cursor.exe'
      - '\Code.exe'
  condition: selection_parent and selection_meta
falsepositives:
  - Normal builds in trusted workspaces
  - Developer-initiated npm, pnpm, yarn, Python, or Node commands
level: medium
---
title: Editor Child Process Making Encoded or Download-Cradle Command
description: Detects encoded PowerShell, download cradles, and direct-from-web execution launched under an editor process tree.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.command_and_control
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Cursor.exe'
      - '\Code.exe'
  selection_flags:
    CommandLine|contains:
      - ' -enc'
      - ' -EncodedCommand'
      - 'FromBase64String'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'curl '
      - 'certutil -urlcache'
      - 'bitsadmin /transfer'
      - 'iex '
  condition: selection_parent and selection_flags
falsepositives:
  - Rare administrative bootstrap activity; investigate parent lineage and workspace trust state
level: critical

// Hunt editor-spawned execution after repository open events. Tune the 2h window to repo-open telemetry if available.
let editorParents = dynamic(['Cursor.exe','cursor.exe','Code.exe']);
let riskyChildren = dynamic(['cmd.exe','powershell.exe','pwsh.exe','node.exe','python.exe','python3.exe','npm.cmd','npx.cmd','wscript.exe','cscript.exe','mshta.exe','rundll32.exe']);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (editorParents)
| where FileName in~ (riskyChildren)
   or ProcessCommandLine has_any ('.vscode\\tasks.json','.vscode\\launch.json','.cursor','preinstall','postinstall','npm run','npx ','pnpm ','yarn ','EncodedCommand','FromBase64String','Invoke-WebRequest','curl ','certutil -urlcache')
| extend SuspiciousFlags = case(
    ProcessCommandLine has_any ('EncodedCommand','FromBase64String','iex ','Invoke-WebRequest'), 'encoded_or_download_cradle',
    ProcessCommandLine has_any ('.vscode\\tasks.json','.cursor','preinstall','postinstall'), 'workspace_hook_reference',
    'editor_spawned_shell')
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256, SuspiciousFlags, ReportId
| order by TimeGenerated desc;

-- Hunt for Cursor/editor process trees launching shells, package managers, or script interpreters
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Exe =~ '(?i)cursor\.exe|/Cursor|cursor' OR Name =~ '(?i)cursor')
   OR CommandLine =~ '(?i)\.vscode|\.cursor|preinstall|postinstall|npm run|npx |pnpm |yarn |EncodedCommand|FromBase64String|Invoke-WebRequest|curl |bash -c|sh -c|python -m|node -e'

# Security Arsenal - Cursor pre-trust execution audit (Windows)
# Run elevated for fleet collection; outputs local evidence only.
$Out = "$env:ProgramData\SecurityArsenal\CursorAudit-$(Get-Date -Format yyyyMMdd-HHmmss).csv"
New-Item -ItemType Directory -Force -Path (Split-Path $Out) | Out-Null

# Inventory likely Cursor install locations and file versions; do not assume fixed version without vendor confirmation.
$paths = @(
  "$env:LOCALAPPDATA\Programs\cursor\Cursor.exe",
  "$env:ProgramFiles\Cursor\Cursor.exe",
  "$env:ProgramFiles(x86)\Cursor\Cursor.exe"
) | Where-Object { Test-Path $_ }

$inventory = foreach ($p in $paths) {
  $v = (Get-Item $p).VersionInfo
  [pscustomobject]@{
    Hostname=$env:COMPUTERNAME
    Path=$p
    ProductVersion=$v.ProductVersion
    FileVersion=$v.FileVersion
    Company=$v.CompanyName
    LastWriteTime=(Get-Item $p).LastWriteTimeUtc
    Action='VERIFY_AGAINST_VENDOR_RELEASE_NOTES'
  }
}

# Capture live editor-spawned shells/interpreters for triage.
$live = Get-CimInstance Win32_Process | Where-Object {
  ($_.Name -match 'cmd.exe|powershell.exe|pwsh.exe|node.exe|python.exe|npm.cmd|npx.cmd|wscript.exe|cscript.exe|mshta.exe|rundll32.exe')
} | ForEach-Object {
  $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue
  if ($parent.Name -match 'cursor.exe|code.exe') {
    [pscustomobject]@{
      Hostname=$env:COMPUTERNAME
      Child=$_.Name
      ChildPid=$_.ProcessId
      ChildCmd=$_.CommandLine
      Parent=$parent.Name
      ParentPid=$parent.ProcessId
      ParentCmd=$parent.CommandLine
      Action='INVESTIGATE_TRUST_STATE_AND_REPO'
    }
  }
}

@($inventory) + @($live) | Export-Csv -NoTypeInformation -Path $Out
Write-Output "Wrote $Out"

# Hardening recommendations to apply via MDM/GPO/Intune after validation:
# - enforce auto-update and block sideloaded editor builds
# - disable automatic task execution and require explicit workspace trust
# - prevent untrusted folders from running build/debug/language-server bootstrap
# - isolate internet-browsing, recruiting, PoC, and dependency-review repos in disposable VMs or dev containers
# - alert on editor parent processes spawning shells, download cradles, or credential-path access

#!/usr/bin/env bash
# Security Arsenal - macOS/Linux Cursor exposure snapshot and triage helper
set -euo pipefail
OUT="/tmp/cursor_pretrust_audit_$(date +%Y%m%d-%H%M%S).txt"
{
  echo "[+] Host: $(hostname)  User: $(id -un)  Time: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
  echo "[+] Candidate Cursor installs:"
  if [[ "$(uname)" == "Darwin" ]]; then
    for app in "/Applications/Cursor.app" "$HOME/Applications/Cursor.app"; do
      [[ -d "$app" ]] && /usr/bin/mdls -name kMDItemVersion "$app" 2>/dev/null || true
    done
    echo "[+] Recent editor-like processes spawning shells/interpreters:"
    /bin/ps axo pid,ppid,user,comm,args | /usr/bin/grep -Ei 'cursor|code' | /usr/bin/grep -Ei 'bash|zsh|sh |python|node|npm|npx|pnpm|yarn' || true
  else
    command -v cursor >/dev/null 2>&1 && cursor --version || echo "cursor CLI not in PATH"
    echo "[+] Editor-like parents with shell/script children:"
    ps -eo pid,ppid,user,comm,args | awk 'BEGIN{IGNORECASE=1} /cursor|code/ {print}' | grep -Ei 'bash|sh|zsh|python|node|npm|npx|pnpm|yarn' || true
  fi
  echo "[+] Workspace metadata and hook candidates in likely project roots:"
  find "$HOME" -maxdepth 4 \( -path '*/.vscode/tasks.json' -o -path '*/.vscode/launch.json' -o -path '*/.cursor/*' -o -name package.json \) 2>/dev/null | head -200
} > "$OUT"
echo "Wrote $OUT"
echo "Review before sharing; redact tokens, hostnames, and repo names as required."