Shadow AI in the Enterprise: Detecting and Governing AI Agent Alerts Flooding Your SOC

---
title: AI Coding Agent CLI Execution Detected
id: 3f8a1c92-7d4e-4b5a-9c31-2e6f8a1b4d57
status: experimental
description: Detects execution of common AI coding agent CLIs (Claude Code, Cursor, Aider, Codex, Copilot CLI). Baseline against sanctioned tool inventory; unsanctioned executions on non-developer endpoints warrant investigation.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\claude.exe'
      - '\codex.exe'
      - '\aider.exe'
      - '\cursor.exe'
      - '\windsurf.exe'
      - '\copilot.exe'
  selection_cmd:
    CommandLine|contains:
      - 'claude --'
      - 'codex exec'
      - 'aider --'
      - 'cursor agent'
  condition: selection_img or selection_cmd
falsepositives:
  - Sanctioned developer AI tooling — suppress per approved tool list and developer OU
level: medium
---
title: AI Agent or Shell Process Reading Credential Stores
id: 9b2e4d71-3c6a-4f18-8d52-1a7c9e3b5f02
status: experimental
description: Detects processes associated with AI agents or agent-spawned shells accessing SSH keys, cloud credential files, or .env secrets. High-fidelity when the reading process is a node/python agent runtime or its child.
references:
  - https://attack.mitre.org/techniques/T1552/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\.ssh\id_'
      - '\.aws\credentials'
      - '\.azure\accessTokens.json'
      - '\.config\gcloud\'
      - '\.kube\config'
  selection_env:
    TargetFilename|endswith:
      - '\.env'
      - '\.env.production'
      - '\.env.local'
  selection_reader:
    Image|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\python3.exe'
      - '\uv.exe'
      - '\claude.exe'
      - '\codex.exe'
  condition: (selection_path or selection_env) and selection_reader
falsepositives:
  - Legitimate agent workflows reading project .env files — suppress per approved agent + project path pairing
level: high
---
title: MCP Server Configuration Written in User Profile
id: 5c1d8f36-2b47-4e93-a764-8f2c6d1e9a83
status: experimental
description: Detects creation or modification of Model Context Protocol server configuration files. MCP configs define which local tools and API keys an agent can invoke; unexpected changes may indicate shadow AI setup or tampering by injected instructions.
references:
  - https://attack.mitre.org/techniques/T1546/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1546
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\.claude.json'
      - '\claude_desktop_config.json'
      - '\.cursor\mcp.json'
      - '\mcp_settings.json'
      - '\.codeium\windsurf\mcp_config.json'
falsepositives:
  - Sanctioned agent installation and updates — alert on non-developer endpoints and off-hours modifications
level: medium

// Hunt: AI agent process trees and consumer AI network footprint
// Part 1: Identify endpoints running AI agent CLIs and what they spawn
let AITools = dynamic(["claude.exe","codex.exe","aider.exe","cursor.exe","windsurf.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has_any (AITools)
   or ProcessCommandLine has_any ("claude --", "codex exec", "aider --")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            ChildProcesses=make_set(FileName, 20), CmdLines=make_set(ProcessCommandLine, 10)
  by DeviceName, AccountName
| order by FirstSeen asc;

// Part 2: Outbound connections to consumer AI SaaS endpoints from corporate devices
// Tune the domain list to your policy; flag devices NOT in your sanctioned-AI group
let AIDomains = dynamic(["chatgpt.com","api.openai.com","claude.ai","api.anthropic.com",
  "gemini.google.com","perplexity.ai","copilot.microsoft.com","huggingface.co"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (AIDomains)
| summarize Connections=count(), DistinctRemoteIPs=dcount(RemoteIP),
            Apps=make_set(InitiatingProcessFileName, 15)
  by DeviceName, InitiatingProcessAccountName
| order by Connections desc;

// Part 3: Agent runtimes (node/python/uv) touching credential stores — possible token theft or overbroad agent
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("\\.ssh\\", "\\.aws\\credentials", "accessTokens.json", "\\.kube\\config")
   or FileName startswith ".env"
| where InitiatingProcessFileName in~ ("node.exe","python.exe","python3.exe","uv.exe","claude.exe","codex.exe")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName
| order by TimeGenerated desc;

-- Hunt: AI agent processes, MCP configs, and agent runtime network connections
-- Collect running AI agents and their parent/child context
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)claude|codex|aider|cursor|windsurf|copilot'
   OR CommandLine =~ '(?i)claude --|codex exec|aider --|mcp'

-- Enumerate MCP and agent configuration files (plaintext API keys often live here)
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/.claude.json',
  'C:/Users/*/.claude/**',
  'C:/Users/*/AppData/Roaming/Claude/claude_desktop_config.json',
  'C:/Users/*/.cursor/mcp.json',
  'C:/Users/*/.codex/**',
  'C:/Users/*/.codeium/windsurf/mcp_config.json'
])

-- Network connections held by agent runtimes — check RemoteAddr against sanctioned AI API ranges
SELECT Pid, Name, LocalAddr, RemoteAddr, Status
FROM netstat()
WHERE Name =~ '(?i)node|python|uv|claude|codex|cursor'
  AND Status =~ 'ESTAB'

# AI Tooling Inventory & Baseline Hardening — run via Intune/SCCM or EDR Live Response
# Outputs: CSV of installed AI tools, MCP configs, and plaintext secrets in agent configs
$report = @()

# 1. Enumerate installed AI tooling per user profile
$aiPaths = @("$env:USERPROFILE\.claude","$env:USERPROFILE\.codex","$env:USERPROFILE\.cursor",
             "$env:USERPROFILE\.codeium","$env:APPDATA\Claude","$env:LOCALAPPDATA\Programs\cursor")
foreach ($p in $aiPaths) {
  if (Test-Path $p) {
    $report += [pscustomobject]@{Type='AIToolInstall'; Path=$p; Modified=(Get-Item $p).LastWriteTime}
  }
}

# 2. Scan MCP configs for plaintext API keys (report presence only — do NOT log key values)
$mcpConfigs = Get-ChildItem "$env:USERPROFILE" -Recurse -Depth 3 -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'mcp.*\.json$|claude_desktop_config\.json|\.claude\.json' }
foreach ($cfg in $mcpConfigs) {
  $raw = Get-Content $cfg.FullName -Raw -ErrorAction SilentlyContinue
  $hasSecret = $raw -match 'sk-[A-Za-z0-9]|api_key|API_KEY|token'
  $report += [pscustomobject]@{Type='MCPConfig'; Path=$cfg.FullName; Modified=$cfg.LastWriteTime;
              ContainsPlaintextSecret=$hasSecret}
}

# 3. Check OAuth grants to consumer AI apps in Entra ID (requires Microsoft.Graph, run by admin)
# Connect-MgGraph -Scopes "Application.Read.All"
# Get-MgOauth2PermissionGrant -All | Where-Object {
#   (Get-MgServicePrincipal -ServicePrincipalId $_.ClientId).DisplayName -match 'OpenAI|Anthropic|Perplexity'
# } | Select-Object ClientId, Scope, ConsentType

# 4. Export findings for SIEM ingestion
$report | Export-Csv -Path "C:\ProgramData\AIInventory_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "AI inventory complete: $($report.Count) artifacts found. Ingest CSV into Sentinel for correlation."