Securing AI Workflows: Deploying Falcon AIDR for Copilot Studio and Claude Code

---
title: Potential Claude Code Jailbreak via Shell Execution
id: 8a4c1d22-5f6e-4b8a-9c1d-2e3f5a6b7c8d
status: experimental
description: Detects Claude Code or associated IDE processes spawning unauthorized shell commands, a common indicator of successful prompt injection or tool misuse.
references:
 - https://www.crowdstrike.com/en-us/blog/falcon-aidr-protects-copilot-studio-agents-and-claude-code/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - 'claude.exe'
      - 'Code.exe' # VS Code host for Claude extension
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_legit_dev:
    CommandLine|contains:
      - 'git'
      - 'npm'
      - 'build'
  condition: selection and not filter_legit_dev
falsepositives:
  - Legitimate developer build processes
level: high
---
title: Suspicious Network Traffic to Anthropic API from Non-Browser
id: 9b5d2e33-6g7f-5c9b-0d2e-3f4g6a7b8c9d
status: experimental
description: Identifies unexpected processes communicating with Anthropic API endpoints, which may indicate unauthorized usage of Claude Code or data exfiltration attempts.
references:
 - https://www.crowdstrike.com/en-us/blog/falcon-aidr-protects-copilot-studio-agents-and-claude-code/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'api.anthropic.com'
    Initiated: true
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  filter_claude_code:
    Image|endswith:
      - '\claude.exe'
  condition: selection and not filter_browsers and not filter_claude_code
falsepositives:
  - Custom scripts integrating with Anthropic API
level: medium

let AnthropicEndpoints = dynamic(["api.anthropic.com", "claude.ai"]);
let CopilotEndpoints = dynamic(["copilotstudio.microsoft.com", "copilot.microsoft.com"]);
DeviceNetworkEvents
| where RemoteUrl in (AnthropicEndpoints) or RemoteUrl in (CopilotEndpoints)
| where Initiated == true
| summarize SentBytes = sum(SentBytes), ReceivedBytes = sum(ReceivedBytes), ConnectionCount = count() by DeviceName, InitiatingProcessFileName, RemoteUrl
| where SentBytes > 5000000 or ConnectionCount > 100 // Thresholds for data exfil or automated abuse
| project DeviceName, InitiatingProcessFileName, RemoteUrl, SentBytes, ConnectionCount, Timestamp
| order by SentBytes desc

-- Hunt for Claude Code and AI Agent Binaries
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/*/*/claude.exe")
WHERE Mode =~ "r-x"

-- Cross-reference with running processes
SELECT Pid, Name, Exe, Username, Ctime
FROM pslist()
WHERE Name =~ "claude" OR Exe =~ "claude"

# Audit and Remediation Check for AI Agent Environment
Write-Host "[+] Starting AI Agent Security Audit..." -ForegroundColor Cyan

# 1. Check CrowdStrike Falcon Sensor Status (Required for AIDR)
$csService = Get-Service -Name "CSFalconService" -ErrorAction SilentlyContinue
if ($csService.Status -eq 'Running') {
    Write-Host "[+] CrowdStrike Falcon Sensor is Running." -ForegroundColor Green
} else {
    Write-Host "[!] ALERT: CrowdStrike Falcon Sensor is not running. AIDR protection is inactive." -ForegroundColor Red
}

# 2. Audit for Claude Code Installation
$claudePaths = @(
    "$env:LOCALAPPDATA\Programs\Claude",
    "$env:USERPROFILE\AppData\Local\Programs\Claude"
)

$foundClaude = $false
foreach ($path in $claudePaths) {
    if (Test-Path $path) {
        Write-Host "[!] Found Claude Code installation at: $path" -ForegroundColor Yellow
        $foundClaude = $true
    }
}

if (-not $foundClaude) {
    Write-Host "[+] No Claude Code installations found in standard user paths." -ForegroundColor Green
}

# 3. Check for Restricted API Keys in Environment Variables (Generic Security Check)
$envVars = Get-ChildItem Env:
$apiKeyPatterns = @("ANTHROPIC_API_KEY", "OPENAI_API_KEY")
foreach ($pattern in $apiKeyPatterns) {
    if ($envVars.Name -contains $pattern) {
        Write-Host "[!] WARNING: API Key pattern '$pattern' found in environment variables." -ForegroundColor Red
    }
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan