Securing AI Agents in Claude Cowork: CrowdStrike Falcon Detection and Hardening Guide for Enterprise Defenders

---
title: AI Agent Process Spawning Shell or Script Interpreter
id: 3f8a2c91-7d4e-4b6a-9c15-2e8f4a1b6d30
status: experimental
description: Detects Claude Cowork or other AI agent executables spawning command shells or script interpreters, consistent with prompt-injection-driven command execution or malicious tool invocation.
references:
  - https://www.crowdstrike.com/en-us/blog/crowdstrike-secures-ai-agents-inside-claude-cowork/
  - https://atlas.mitre.org/techniques/AML.T0051
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\claude.exe'
      - '\Claude.exe'
      - '\claude-cowork.exe'
      - '\anthropic-agent.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Approved agent workflows that legitimately execute scripts or fetch remote content — baseline by parent command line and user
level: high
---
title: AI Agent or MCP Configuration File Modification
id: 8c1e5a47-3b92-4f68-ad27-9d4c6e0b5f18
status: experimental
description: Detects creation or modification of Claude/MCP configuration files, which may indicate persistence via rogue MCP server registration or tool poisoning.
references:
  - https://www.crowdstrike.com/en-us/blog/crowdstrike-secures-ai-agents-inside-claude-cowork/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.persistence
  - attack.t1546
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\.claude.json'
      - '\claude_desktop_config.json'
      - '\.claude\settings.json'
      - '\mcp.json'
      - '\.mcp\'
  condition: selection
falsepositives:
  - Legitimate user or admin configuration of agent tooling — alert on changes outside change windows or by non-admin users
level: medium
---
title: Unsigned Executable Egress to LLM API Endpoints
id: 5d7b3e29-1a48-4c95-bf62-8a3e9d0c7b41
status: experimental
description: Detects unsigned or unusual processes establishing connections to LLM API endpoints, potentially indicating shadow AI tooling or data staged for exfiltration through an AI service.
references:
  - https://atlas.mitre.org/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'api.anthropic.com'
      - 'api.openai.com'
  selection_unsigned:
    Signed: 'false'
  condition: selection_dest and selection_unsigned
falsepositives:
  - Developer tooling and unsigned internal scripts using LLM APIs — correlate with process path and user context
level: medium

// Hunt: AI agent runtimes spawning high-risk child processes or touching sensitive locations
// Tables: DeviceProcessEvents (Defender XDR) — extend with DeviceFileEvents for config tampering
let AgentProcesses = dynamic(["claude.exe", "claude-cowork.exe", "anthropic-agent.exe", "mcp-server.exe"]);
let HighRiskChildren = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "rundll32.exe", "mshta.exe", "curl.exe", "wscript.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (AgentProcesses)
| where FileName in~ (HighRiskChildren)
| project TimeGenerated, DeviceName, AccountName,
    AgentCmdLine = InitiatingProcessCommandLine,
    ChildProcess = FileName,
    ChildCmdLine = ProcessCommandLine,
    SHA256, ReportId
| order by TimeGenerated desc;

// Companion hunt: agent/MCP configuration file changes by non-admin accounts
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("claude_desktop_config.json", ".claude.json", "mcp.json", "settings.json")
| where FolderPath has_any ("claude", "mcp", "anthropic")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, InitiatingProcessFileName
| order by TimeGenerated desc;

-- Hunt for AI agent installations, MCP configuration artifacts, and agent-spawned processes
-- Artifact: Security.AI.AgentSurfaceAudit

-- 1) Enumerate running agent processes and their children
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)claude|anthropic|mcp'
   OR CommandLine =~ '(?i)claude|mcp-server|anthropic'

-- 2) Locate agent and MCP configuration files across user profiles
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/AppData/Roaming/Claude/*.json',
  'C:/Users/*/.claude.json',
  'C:/Users/*/.claude/**',
  'C:/Users/*/.mcp/**',
  '/Users/*/Library/Application Support/Claude/*.json',
  '/home/*/.claude.json'
])

-- 3) Review active connections to LLM API infrastructure
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE RemoteAddress =~ 'anthropic|openai'
   OR RemotePort in (443) AND Name =~ '(?i)claude|mcp'

# AI Agent Security Baseline Audit — run elevated on Windows endpoints
# 1) Enumerate installed agentic AI tooling (shadow AI discovery)
Write-Host "=== Installed AI Agent Tooling ===" -ForegroundColor Cyan
$paths = @("$env:ProgramFiles", "${env:ProgramFiles(x86)}", "$env:LOCALAPPDATA\Programs")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Directory -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -match 'claude|anthropic|copilot|cursor|mcp' } |
        Select-Object FullName, CreationTime
}

# 2) Inventory MCP/agent config files and flag recently modified ones
Write-Host "=== Agent/MCP Configuration Files ===" -ForegroundColor Cyan
Get-ChildItem -Path "C:\Users" -Recurse -Include "claude_desktop_config.json",".claude.json","mcp.json" -ErrorAction SilentlyContinue |
    Select-Object FullName, LastWriteTime | Sort-Object LastWriteTime -Descending

# 3) Parse MCP configs for unapproved server entries
Write-Host "=== Registered MCP Servers ===" -ForegroundColor Cyan
Get-ChildItem -Path "C:\Users" -Recurse -Include "claude_desktop_config.json","mcp.json" -ErrorAction SilentlyContinue | ForEach-Object {
    $cfg = Get-Content $_.FullName -Raw | ConvertFrom-Json -ErrorAction SilentlyContinue
    if ($cfg.mcpServers) {
        $cfg.mcpServers.PSObject.Properties | ForEach-Object {
            [PSCustomObject]@{ ConfigFile = $_.Name; Server = $_.Name; Command = $_.Value.command; Args = ($_.Value.args -join ' ') }
        }
    }
}

# 4) Verify CrowdStrike Falcon sensor health (agent protections require a running sensor)
Write-Host "=== Falcon Sensor Status ===" -ForegroundColor Cyan
Get-Service -Name CSFalconService -ErrorAction SilentlyContinue | Select-Object Name, Status, StartType

# 5) Flag agent processes with active external connections
Write-Host "=== Agent Processes with Network Connections ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.Name -match 'claude|mcp|anthropic') {
        [PSCustomObject]@{ Process = $proc.Name; PID = $proc.Id; RemoteIP = $_.RemoteAddress; RemotePort = $_.RemotePort }
    }
}