Forensic Reconstruction of AI Coding Agents: Detection, Artifact Locations, and IR Playbook for Claude Code, Codex, Gemini CLI, and OpenCode

---
title: AI Coding Agent Spawning Shell or Interpreter
id: 3f8a1c74-2b6e-4d91-a7c3-9e0f5b2d8a41
status: experimental
description: Detects known AI coding agent processes spawning command shells or script interpreters. Agent tool-call execution is expected in dev environments, but this lineage is the primary indicator of prompt-injection-driven execution and attacker abuse of local agents.
references:
  - https://isc.sans.edu/diary/rss/33410
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\claude.exe'
      - '\codex.exe'
      - '\gemini.exe'
      - '\opencode.exe'
      - '\qwen.exe'
      - '\hermes.exe'
      - '\Cursor.exe'
      - '\Windsurf.exe'
      - '\Warp.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_claude_code:
    ParentImage|endswith: '\node.exe'
    ParentCommandLine|contains:
      - 'claude'
      - 'codex'
      - 'gemini'
      - 'opencode'
condition: selection_parent and selection_child and not filter_claude_code
falsepositives:
  - Legitimate agent tool-call execution during approved development work
level: medium
---
title: AI Agent Transcript Directory Creation on Endpoint
id: 91c2e5b8-4a7f-4c36-b8d2-6f1a9e3c5d07
status: experimental
description: Detects creation of AI coding agent configuration and transcript directories. Useful for shadow-AI discovery on systems where AI agents are not sanctioned, and for establishing first-seen timelines during IR.
references:
  - https://isc.sans.edu/diary/rss/33410
  - https://attack.mitre.org/techniques/T1074/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1074
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\.claude\projects\'
      - '\.codex\sessions\'
      - '\.gemini\tmp\'
      - '\.qwen\'
      - '\.local\share\opencode\'
      - '\.codeium\windsurf\'
      - '\.hermes\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsonl'
      - '.json'
condition: selection and selection_ext
falsepositives:
  - Approved developer use of AI coding assistants
level: low
---
title: AI Agent Access to Credential and Secret Files
id: b47d3f29-8c1a-4e52-9d6b-2a8f4c7e1935
status: experimental
description: Detects AI agent processes accessing SSH keys, cloud credentials, or environment secret files. A primary exfiltration and over-permissioning indicator — agent tool calls reading secrets means that content likely transited to an external LLM API.
references:
  - https://isc.sans.edu/diary/rss/33410
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\.ssh\id_'
      - '\.aws\credentials'
      - '\.azure\'
      - '\.config\gcloud\'
      - '\.env'
      - '\.npmrc'
      - '\.netrc'
  selection_ext:
    TargetFilename|endswith:
      - '\id_rsa'
      - '\id_ed25519'
      - 'credentials'
      - '.env'
condition: selection_paths or (selection_ext and selection_paths)
falsepositives:
  - Legitimate developer tooling and backup software accessing these paths
level: high

let AgentProcesses = dynamic(["claude.exe","codex.exe","gemini.exe","opencode.exe","qwen.exe","hermes.exe","Cursor.exe","Windsurf.exe","Warp.exe"]);
let HighRiskChildren = dynamic(["powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","curl.exe","certutil.exe","bitsadmin.exe","rundll32.exe","regsvr32.exe"]);
let AgentParents = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (AgentProcesses)
   or (FileName =~ "node.exe" and ProcessCommandLine has_any ("claude","codex","gemini-cli","opencode","qwen-code"))
| project AgentDeviceId = DeviceId, AgentDevice = DeviceName, AgentProcessId = ProcessId, AgentName = FileName, AgentCmd = ProcessCommandLine, AgentUser = AccountName, AgentTime = TimeGenerated;
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| join kind=inner AgentParents on $left.DeviceId == $right.AgentDeviceId and $left.InitiatingProcessId == $right.AgentProcessId
| extend RiskFlag = iff(FileName in~ (HighRiskChildren), "HIGH", "INFO")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ChildCount = count(), HighRiskCount = countif(RiskFlag == "HIGH"), SampleCommands = make_set(strcat(FileName, " | ", ProcessCommandLine), 5) by AgentDevice, AgentName, AgentUser, RiskFlag
| order by HighRiskCount desc, ChildCount desc

// Stage 2: Hunt transcript file creation for shadow-AI discovery and IR timeline anchoring
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FolderPath has_any ("\\.claude\\projects\\","\\.codex\\sessions\\","\\.gemini\\tmp\\","\\.qwen\\","\\opencode\\storage\\","\\.codeium\\windsurf\\","\\.hermes\\")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), FileCount = count(), SamplePaths = make_set(FolderPath, 3) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| order by FirstSeen asc

-- Hunt: enumerate AI coding agent artifacts and transcripts across user profiles
LET agent_globs = {
  "ClaudeCode": "C:/Users/*/.claude/projects/**/*.jsonl",
  "Codex": "C:/Users/*/.codex/sessions/**/*.jsonl",
  "GeminiCLI": "C:/Users/*/.gemini/tmp/*/logs.json",
  "QwenCode": "C:/Users/*/.qwen/**",
  "OpenCode": "C:/Users/*/.local/share/opencode/**",
  "Windsurf": "C:/Users/*/.codeium/windsurf/**",
  "Hermes": "C:/Users/*/.hermes/**"
}

SELECT Agent, FullPath, Size, Mtime
FROM foreach(row=agent_globs,
  query={
    SELECT _value AS Agent, FullPath, Size, Mtime
    FROM glob(globs=_value)
  })
ORDER BY Mtime DESC

-- Hunt: running AI agent processes and their child processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_member(field="Name", item=process_memory(pid=Ppid)) AS ParentName
FROM pslist()
WHERE Name =~ '(?i)claude|codex|gemini|opencode|qwen|hermes|cursor|windsurf|warp'
   OR CommandLine =~ '(?i)claude|codex-cli|gemini-cli|opencode|qwen-code'

# AI Agent Inventory & Audit Script — run as SYSTEM or admin for full user-profile coverage
# Output: JSON report per endpoint at C:\ProgramData\SecurityOps\AIAgentAudit-<hostname>.json

$reportDir = 'C:\ProgramData\SecurityOps'
New-Item -ItemType Directory -Path $reportDir -Force | Out-Null

# Define approved agents for YOUR environment — anything outside this list is flagged
$approvedAgents = @('claude', 'copilot')

$agentArtifacts = @{
    'ClaudeCode' = @('.claude\projects', '.claude.json')
    'Codex'      = @('.codex\sessions', '.codex\config.toml')
    'GeminiCLI'  = @('.gemini\tmp', '.gemini\settings.json')
    'Cursor'     = @('AppData\Roaming\Cursor\User\workspaceStorage')
    'Copilot'    = @('AppData\Roaming\Code\User\workspaceStorage')
    'Warp'       = @('AppData\Local\warp')
    'Windsurf'   = @('.codeium\windsurf')
    'QwenCode'   = @('.qwen')
    'OpenCode'   = @('.local\share\opencode')
    'Hermes'     = @('.hermes', 'AppData\Roaming\hermes')
}

$findings = @()
Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue | ForEach-Object {
    $userProfile = $_.FullName
    foreach ($agent in $agentArtifacts.GetEnumerator()) {
        foreach ($relPath in $agent.Value) {
            $full = Join-Path $userProfile $relPath
            if (Test-Path $full) {
                $item = Get-Item $full -ErrorAction SilentlyContinue
                $agentKey = $agent.Key.ToLower()
                $findings += [PSCustomObject]@{
                    Agent        = $agent.Key
                    UserProfile  = $userProfile
                    Path         = $full
                    LastWrite    = $item.LastWriteTime
                    Approved     = ($approvedAgents | Where-Object { $agentKey -like "*$_*" }).Count -gt 0
                }
            }
        }
    }
}

# Check running agent processes right now
$running = Get-Process -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'claude|codex|gemini|opencode|qwen|hermes|cursor|windsurf|warp' } |
    Select-Object Name, Id, Path

$report = [PSCustomObject]@{
    Hostname          = $env:COMPUTERNAME
    ScanTime          = (Get-Date).ToString('o')
    ArtifactsFound    = $findings
    UnauthorizedCount = ($findings | Where-Object { -not $_.Approved }).Count
    RunningAgents     = $running
}

$outFile = Join-Path $reportDir "AIAgentAudit-$env:COMPUTERNAME.json"
$report | ConvertTo-Json -Depth 4 | Out-File $outFile -Encoding utf8
Write-Output "Audit complete: $($findings.Count) artifacts, $($report.UnauthorizedCount) unauthorized -> $outFile"

#!/usr/bin/env bash
# AI agent artifact audit for Linux/macOS — run via your MDM or config management
REPORT="/var/log/ai-agent-audit-$(hostname)-$(date +%F).json"
echo "{\"hostname\":\"$(hostname)\",\"findings\":[" > "$REPORT"
first=1
for home in /home/* /Users/* /root; do
  for path in ".claude/projects" ".codex/sessions" ".gemini/tmp" ".qwen" \
              ".local/share/opencode" ".codeium/windsurf" ".hermes" ".warp"; do
    full="$home/$path"
    if [ -e "$full" ]; then
      [ $first -eq 0 ] && echo "," >> "$REPORT"
      first=0
      mtime=$(stat -c '%y' "$full" 2>/dev/null || stat -f '%Sm' "$full" 2>/dev/null)
      echo "{\"user\":\"$home\",\"path\":\"$full\",\"mtime\":\"$mtime\"}" >> "$REPORT"
    fi
  done
done
echo "]}" >> "$REPORT"
# Flag running agents
ps -eo user,comm,args | grep -iE 'claude|codex|gemini|opencode|qwen|hermes' | grep -v grep