Numbat and AI Agent Observability: A Defender's Guide to Detecting Rogue Agents, MCP Abuse, and Shadow AI in 2026

---
title: AI Agent Runtime Spawning Shell or Script Interpreter
id: 3f2a9c41-7b8e-4d12-9a6f-5c1e8b2d4a90
status: experimental
description: Detects AI agent runtimes (Claude Code, Cursor, MCP host processes) spawning shells or script interpreters. Legitimate for coding agents, but high-fidelity when combined with unexpected parent, user context, or off-hours execution. Tune the parent image list to agents sanctioned in your environment.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://isc.sans.edu/diary/rss/33312
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\claude.exe'
      - '\cursor.exe'
      - '\windsurf.exe'
      - '\node.exe'
      - '\Code.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Developer agents legitimately running build/test commands; baseline per-user and alert on deviation
level: medium
---
title: MCP Server Installed via npx or uvx with Execution Policy Bypass
id: 8c4d1e72-3a56-4f89-b2d7-9e0a6c4f1b35
status: experimental
description: Detects on-demand package execution (npx, uvx) pulling and running MCP servers or scripts with bypass flags, encoded commands, or download cradles. A common delivery mechanism for trojanized MCP tool servers.
references:
  - https://attack.mitre.org/techniques/T1105/
  - https://isc.sans.edu/diary/rss/33312
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\npx.cmd'
      - '\npx.exe'
      - '\uvx.exe'
      - '\uv.exe'
      - '\bunx.exe'
  selection_flags:
    CommandLine|contains:
      - '-y '
      - '--yes'
      - 'mcp'
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - '-enc '
      - 'FromBase64String'
  condition: selection_img and selection_flags
falsepositives:
  - Developers installing legitimate MCP servers; alert on first-seen package names per host
level: high
---
title: Agent Configuration or Credential File Modified Outside Install Window
id: 5b7e3a18-2c94-4d60-8f1a-7d3c9e5b6a42
status: experimental
description: Detects writes to AI agent configuration files that frequently contain MCP server definitions, API keys, and OAuth tokens. Unexpected modification can indicate malicious MCP server registration or token theft staging.
references:
  - https://attack.mitre.org/techniques/T1552/
  - https://isc.sans.edu/diary/rss/33312
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\.claude.json'
      - '\.claude\'
      - 'mcp.json'
      - '\.cursor\mcp.json'
      - '\.config\claude\'
      - '\continue\config.json'
  filter_installer:
    Image|endswith:
      - '\claude.exe'
      - '\cursor.exe'
      - '\msiexec.exe'
  condition: selection and not filter_installer
falsepositives:
  - Users editing MCP configuration manually; correlate with change tickets and version control
level: high

let llm_endpoints = dynamic(["api.openai.com", "api.anthropic.com", "api.cohere.com", "generativelanguage.googleapis.com", "api.mistral.ai", "openrouter.ai", "api.groq.com", "bedrock-runtime", "azure-api.net"]);  
// Part 1: Shadow AI — unexpected processes connecting to LLM API endpoints
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any (llm_endpoints) or RemoteUrl contains "openai"
| extend ProcessName = tolower(split(InitiatingProcessFileName, ".")[0])
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ConnectionCount=count(), Devices=dcount(DeviceId), DeviceList=make_set(DeviceName, 20) by InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, InitiatingProcessAccountName
| order by ConnectionCount desc
;
// Part 2: Agent runtimes spawning shells/scripting engines or network tools
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName has_any ("claude.exe", "cursor.exe", "windsurf.exe", "node.exe", "uvx.exe", "npx.cmd")
| where FileName has_any ("powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "certutil.exe", "mshta.exe", "rundll32.exe")
   or ProcessCommandLine has_any ("FromBase64String", "DownloadString", "-enc", "Invoke-Expression")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc

-- Inventory AI agent runtimes and their configuration files for credential exposure and rogue MCP servers
SELECT
    process.Pid AS Pid,
    process.Name AS ProcessName,
    process.CommandLine AS CommandLine,
    process.Username AS Username
FROM pslist()
WHERE CommandLine =~ '(?i)claude|cursor|windsurf|mcp|uvx|npx'

LET configs = SELECT
    FullPath,
    Size,
    Mtime AS Modified
FROM glob(
    globs=[
        'C:/Users/*/.claude.json',
        'C:/Users/*/.claude/**',
        'C:/Users/*/.cursor/mcp.json',
        'C:/Users/*/AppData/Roaming/Claude/**',
        'C:/Users/*/.config/claude/**',
        'C:/Users/**/mcp.json'
    ],
    accessor='ntfs'
)

SELECT FullPath, Size, Modified,
       read_file(filename=FullPath, length=4096) AS ConfigHead
FROM configs

# AI Agent Inventory & Exposure Audit — run elevated, output to CSV for central collection
$report = @()

# 1) Find installed agent runtimes and MCP-related processes
$agentProcs = Get-CimInstance Win32_Process | Where-Object {
    $_.CommandLine -match '(?i)claude|cursor|windsurf|uvx|npx|mcp-server'
}
foreach ($p in $agentProcs) {
    $report += [pscustomobject]@{
        Type='Process'; Host=$env:COMPUTERNAME; Path=$p.ExecutablePath
        Detail=$p.CommandLine; Risk='Review - active agent/MCP process'
    }
}

# 2) Locate agent config files and flag embedded secrets (never print the secret itself)
$users = Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue
foreach ($u in $users) {
    $configs = Get-ChildItem -Path $u.FullName -Recurse -Force -ErrorAction SilentlyContinue \
        -Include '.claude.json','mcp.json','config.json' |
        Where-Object { $_.FullName -match '(?i)claude|cursor|mcp|continue|windsurf' }
    foreach ($c in $configs) {
        $content = Get-Content $c.FullName -Raw -ErrorAction SilentlyContinue
        $risk = if ($content -match '(?i)api[_-]?key|token|secret|Bearer') {
            'HIGH - plaintext credential likely present in agent config'
        } else { 'Info - agent config found' }
        $report += [pscustomobject]@{
            Type='Config'; Host=$env:COMPUTERNAME; Path=$c.FullName
            Detail="Modified $($c.LastWriteTime)"; Risk=$risk
        }
    }
}

# 3) Audit active connections to LLM API endpoints
$llmHosts = 'api.openai.com','api.anthropic.com','api.cohere.com','openrouter.ai','api.mistral.ai'
foreach ($h in $llmHosts) {
    $ips = (Resolve-DnsName $h -Type A -ErrorAction SilentlyContinue).IPAddress
    if ($ips) {
        Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
            Where-Object { $ips -contains $_.RemoteAddress } |
            ForEach-Object {
                $owner = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
                $report += [pscustomobject]@{
                    Type='Network'; Host=$env:COMPUTERNAME; Path=$h
                    Detail="Process: $owner"; Risk='Review - egress to LLM API'
                }
            }
    }
}

$report | Export-Csv -Path "$env:TEMP\agent-exposure-audit.csv" -NoTypeInformation
Write-Output "Audit complete: $($report.Count) findings -> $env:TEMP\agent-exposure-audit.csv"