Trojanized Claude Code Extension on the Cursor Marketplace

// HUNT: Reverse SSH tunnel with the published command-line shape (ssh -N -R '*:0:localhost:22')
// MITRE: T1572, T1021.004
// CONF: high  FP: medium  COST: low
// REQUIRES: process creation with command line on Windows, macOS or Linux sensors
// FALSE POSITIVES: sanctioned reverse tunnels to a bastion; autossh keep-alive tunnels managed by IT
// TUNING: exclude your sanctioned tunnel hosts and service accounts from the autossh branch; the -R wildcard branch should be near zero on developer machines
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(ssh|autossh)(\.exe)?$/i
| CommandLine=/(-R\s+\S*\*:0:localhost:22|-M\s+0\b.*StrictHostKeyChecking=no|StrictHostKeyChecking=no.*-M\s+0\b)/i
| table([@timestamp, event_platform, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: Reverse SSH tunnel with the published command-line shape (ssh -N -R '*:0:localhost:22')
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1572, T1021.004
// CONF: high | FP: medium
// FALSE POSITIVES: sanctioned reverse tunnels to a bastion; autossh keep-alive tunnels managed by IT
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: ssh or autossh by name, and either the wildcard reverse-forward shape or the autossh keep-alive shape with host-key checking off. contains is case-insensitive, which reproduces the CQL /i intent. The CQL word boundary and whitespace tolerance are flattened to substring tests.
// REQUIRES: SentinelOne Deep Visibility process-creation events with command line (event.type Process Creation) on Windows, macOS or Linux agents
// TUNING: Exclude sanctioned tunnel hosts and service accounts from the autossh branch; the wildcard reverse-forward branch should be near zero on developer machines.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No data tables or lookups required; set the console time picker to the lookback.
// KNOWN GAPS: A tunnel started by a renamed ssh binary is not matched by name.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.name in:anycase ('ssh', 'ssh.exe', 'autossh', 'autossh.exe') and ((tgt.process.cmdline contains '-R' and tgt.process.cmdline contains '*:0:localhost:22') or (tgt.process.cmdline contains '-M 0' and tgt.process.cmdline contains 'StrictHostKeyChecking=no'))
| columns event.time, endpoint.name, endpoint.os, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Reverse SSH tunnel with the published command-line shape (ssh -N -R '*:0:localhost:22')
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1572, T1021.004
// CONF: high | FP: medium
// FALSE POSITIVES: sanctioned reverse tunnels to a bastion; autossh keep-alive tunnels managed by IT
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: ssh or autossh by name, and either the wildcard reverse-forward shape or the autossh keep-alive shape with host-key checking off. contains is case-insensitive, which reproduces the CQL /i intent. The CQL word boundary and whitespace tolerance are flattened to substring tests.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude sanctioned tunnel hosts and service accounts from the autossh branch; the wildcard reverse-forward branch should be near zero on developer machines.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A tunnel started by a renamed ssh binary is not matched by name.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("ssh", "ssh.exe", "autossh", "autossh.exe")
| where (ProcessCommandLine contains "-R" and ProcessCommandLine contains "*:0:localhost:22") or (ProcessCommandLine contains "-M 0" and ProcessCommandLine contains "StrictHostKeyChecking=no")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Connection to the published attacker server (tunnel TCP 22, beacon TCP 8099)
// MITRE: T1572, T1071.001
// CONF: high  FP: low  COST: low
// REQUIRES: outbound network connection events (IPv4)
// FALSE POSITIVES: address reassignment after takedown (the host belongs to a cloud provider)
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4="134.209.82.225"
| table([@timestamp, event_platform, ComputerName, aid, ContextBaseFileName, LocalAddressIP4, RemoteAddressIP4, RemotePort])

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, dst.ip.address, dst.port.number

// HUNT: Connection to the published attacker server (tunnel TCP 22, beacon TCP 8099)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1572, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: address reassignment after takedown (the host belongs to a cloud provider)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an outbound IPv4 connection whose remote address is the published attacker server, on any port.
// REQUIRES: SentinelOne Deep Visibility network events (event.type IP Connect)
// TUNING: None needed: the match is an exact address. Re-check ownership of the address if hits appear long after the takedown.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No data tables or lookups required; set the console time picker to the lookback.
// KNOWN GAPS: Connections that reach the server through a proxy or CDN show the proxy address, not this one.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' and dst.ip.address = '134.209.82.225'
| columns event.time, endpoint.name, src.process.name, src.ip.address, dst.ip.address, dst.port.number
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort
| take 5

// HUNT: Connection to the published attacker server (tunnel TCP 22, beacon TCP 8099)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1572, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: address reassignment after takedown (the host belongs to a cloud provider)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an outbound IPv4 connection whose remote address is the published attacker server, on any port.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: None needed: the match is an exact address. Re-check ownership of the address if hits appear long after the takedown.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections that reach the server through a proxy or CDN show the proxy address, not this one.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where RemoteIP == "134.209.82.225"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, LocalIP, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: Persistence and SSH-enablement commands from the trojanized loader
// MITRE: T1053.005, T1543.001, T1021.004, T1036.004
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line on Windows and macOS sensors
// FALSE POSITIVES: IT provisioning that enables Remote Login or OpenSSH Server; software that registers a task named SysMon
// TUNING: exclude MDM and provisioning parents (ParentBaseFileName) and your build accounts; keep the SysMon and com.apple.sysmond branches unfiltered because the names are the signal
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (FileName=/^schtasks(\.exe)?$/i and CommandLine=/\bcreate\b.*\bSysMon\b/i)
  or (FileName=/^launchctl$/i and CommandLine=/com\.apple\.sysmond/i)
  or (FileName=/^systemsetup$/i and CommandLine=/-setremotelogin\s+on/i)
  or (FileName=/^powershell(\.exe)?$/i and CommandLine=/Add-WindowsCapability.*OpenSSH\.Server/i)
| table([@timestamp, event_platform, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: Persistence and SSH-enablement commands from the trojanized loader
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005, T1543.001, T1021.004, T1036.004
// CONF: medium | FP: medium
// FALSE POSITIVES: IT provisioning that enables Remote Login or OpenSSH Server; software that registers a task named SysMon
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four process-creation branches: schtasks creating a task named SysMon, launchctl naming com.apple.sysmond, systemsetup enabling remote login, and PowerShell adding the OpenSSH server capability. contains and matches are case-insensitive, which reproduces the CQL /i intent. The CQL word order between create and SysMon is not enforced.
// REQUIRES: SentinelOne Deep Visibility process-creation events with command line on Windows and macOS agents
// TUNING: Exclude MDM and provisioning parents (src.process.name) and build accounts; keep the SysMon and com.apple.sysmond branches unfiltered because the names are the signal.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No data tables or lookups required; set the console time picker to the lookback.
// KNOWN GAPS: Persistence created through the Task Scheduler API rather than schtasks is not matched by this card.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and ((tgt.process.name in:anycase ('schtasks', 'schtasks.exe') and tgt.process.cmdline contains 'create' and tgt.process.cmdline contains 'SysMon') or (tgt.process.name in:anycase ('launchctl') and tgt.process.cmdline contains 'com.apple.sysmond') or (tgt.process.name in:anycase ('systemsetup') and tgt.process.cmdline matches '-setremotelogin\\s+on') or (tgt.process.name in:anycase ('powershell', 'powershell.exe') and tgt.process.cmdline contains 'Add-WindowsCapability' and tgt.process.cmdline contains 'OpenSSH.Server'))
| columns event.time, endpoint.name, endpoint.os, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Persistence and SSH-enablement commands from the trojanized loader
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005, T1543.001, T1021.004, T1036.004
// CONF: medium | FP: medium
// FALSE POSITIVES: IT provisioning that enables Remote Login or OpenSSH Server; software that registers a task named SysMon
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four process-creation branches: schtasks creating a task named SysMon, launchctl naming com.apple.sysmond, systemsetup enabling remote login, and PowerShell adding the OpenSSH server capability. contains and (?i) regex are case-insensitive, which reproduces the CQL /i intent. The CQL word order between create and SysMon is not enforced.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Windows and macOS devices
// TUNING: Exclude MDM and provisioning parents (InitiatingProcessFileName) and build accounts; keep the SysMon and com.apple.sysmond branches unfiltered because the names are the signal.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Persistence created through the Task Scheduler API rather than schtasks is not matched by this card.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where (FileName in~ ("schtasks.exe", "schtasks") and ProcessCommandLine contains "create" and ProcessCommandLine contains "SysMon") or (FileName =~ "launchctl" and ProcessCommandLine contains "com.apple.sysmond") or (FileName =~ "systemsetup" and ProcessCommandLine matches regex @"(?i)-setremotelogin\s+on") or (FileName in~ ("powershell.exe", "powershell") and ProcessCommandLine contains "Add-WindowsCapability" and ProcessCommandLine contains "OpenSSH.Server")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Cursor process tree spawning key, task, launch-object or tunnel commands
// MITRE: T1195.002, T1098.004, T1572
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with parent on Windows or macOS sensors; the parent name can differ by Cursor version
// FALSE POSITIVES: Remote-SSH port forwards; developers running these commands in the integrated terminal
// TUNING: exclude known developer accounts for the -R branch only; keep authorized_keys, SysMon, sysmond and .stk_ branches unfiltered; confirm with Q5 and the Section 7 checks
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^cursor/i
| CommandLine=/(authorized_keys|\bschtasks\b.*\bcreate\b|\blaunchctl\b.*(load|bootstrap)|setremotelogin|Add-WindowsCapability|-R\s+\S*:\d+:\S*:22\b|\.config.\.smt|smt\.cmd|sysmon\.cmd|\.stk_[0-9a-f]{10})/i
| table([@timestamp, event_platform, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, src.process.name, tgt.process.cmdline

// HUNT: Cursor process tree spawning key, task, launch-object or tunnel commands
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1195.002, T1098.004, T1572
// CONF: medium | FP: medium
// FALSE POSITIVES: Remote-SSH port forwards; developers running these commands in the integrated terminal
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a process whose creator name starts with cursor, created with a command line that names the key file, task, launch-object, remote-login or tunnel shapes. The creator is src.process.name on a Process Creation event, and the whole CQL command-line regex is kept as one case-insensitive matches test.
// REQUIRES: SentinelOne Deep Visibility process-creation events with creator and command line on Windows or macOS agents; the creator name can differ by Cursor version
// TUNING: Exclude known developer accounts for the -R branch only; keep the authorized_keys, SysMon, sysmond and .stk_ branches unfiltered; confirm with Q5 and the Section 7 checks.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No data tables or lookups required; set the console time picker to the lookback.
// KNOWN GAPS: A Cursor helper whose process name does not begin with cursor is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and src.process.name matches '^cursor.*' and tgt.process.cmdline matches '.*(authorized_keys|\\bschtasks\\b.*\\bcreate\\b|\\blaunchctl\\b.*(load|bootstrap)|setremotelogin|Add-WindowsCapability|-R\\s+\\S*:\\d+:\\S*:22\\b|\\.config.\\.smt|smt\\.cmd|sysmon\\.cmd|\\.stk_[0-9a-f]{10}).*'
| columns event.time, endpoint.name, endpoint.os, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, ProcessCommandLine
| take 5

// HUNT: Cursor process tree spawning key, task, launch-object or tunnel commands
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1195.002, T1098.004, T1572
// CONF: medium | FP: medium
// FALSE POSITIVES: Remote-SSH port forwards; developers running these commands in the integrated terminal
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a process whose parent name starts with cursor, created with a command line that names the key file, task, launch-object, remote-login or tunnel shapes. The parent is InitiatingProcessFileName and startswith is case-insensitive, and the whole CQL command-line regex is kept under a (?i) prefix.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) with the initiating process on Windows or macOS devices; the parent name can differ by Cursor version
// TUNING: Exclude known developer accounts for the -R branch only; keep the authorized_keys, SysMon, sysmond and .stk_ branches unfiltered; confirm with Q5 and the Section 7 checks.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A Cursor helper whose process name does not begin with cursor is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName startswith "cursor"
| where ProcessCommandLine matches regex @"(?i)(authorized_keys|\bschtasks\b.*\bcreate\b|\blaunchctl\b.*(load|bootstrap)|setremotelogin|Add-WindowsCapability|-R\s+\S*:\d+:\S*:22\b|\.config.\.smt|smt\.cmd|sysmon\.cmd|\.stk_[0-9a-f]{10})"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Execution that references the dropped persistence and tunnel-key artifacts
// MITRE: T1053.003, T1053.005, T1543.001, T1547.001, T1572
// CONF: high  FP: low  COST: low
// REQUIRES: process creation with command line on Windows, macOS and Linux sensors
// FALSE POSITIVES: an unrelated tool that happens to use a file named sysmon.cmd; none known
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (FileName=/^(\.smtk?|smt\.cmd|sysmon\.cmd)$/i or CommandLine=/(\.config.\.smtk?\b|\.config.smt\.cmd|sysmon\.cmd|\.stk_[0-9a-f]{10}|@reboot.*\.smt)/i)
| table([@timestamp, event_platform, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: Execution that references the dropped persistence and tunnel-key artifacts
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.003, T1053.005, T1543.001, T1547.001, T1572
// CONF: high | FP: low
// FALSE POSITIVES: an unrelated tool that happens to use a file named sysmon.cmd; none known
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process named like the dropped artifacts, or a command line that references them. Names use a case-insensitive list and the command-line regex is kept as one case-insensitive matches test.
// REQUIRES: SentinelOne Deep Visibility process-creation events with command line on Windows, macOS and Linux agents
// TUNING: None needed for the artifact names; an unrelated tool that happens to use a file named sysmon.cmd is the only known false positive.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No data tables or lookups required; set the console time picker to the lookback.
// KNOWN GAPS: Files dropped but never executed are not process events and are not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name in:anycase ('.smt', '.smtk', 'smt.cmd', 'sysmon.cmd') or tgt.process.cmdline matches '.*(\\.config.\\.smtk?\\b|(?:\\.)config.smt\\.cmd|sysmon\\.cmd|\\.stk_[0-9a-f]{10}|@reboot.*\\.smt).*')
| columns event.time, endpoint.name, endpoint.os, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Execution that references the dropped persistence and tunnel-key artifacts
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.003, T1053.005, T1543.001, T1547.001, T1572
// CONF: high | FP: low
// FALSE POSITIVES: an unrelated tool that happens to use a file named sysmon.cmd; none known
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process named like the dropped artifacts, or a command line that references them. Names use a case-insensitive list and the command-line regex is kept under a (?i) prefix.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Windows, macOS and Linux devices
// TUNING: None needed for the artifact names; an unrelated tool that happens to use a file named sysmon.cmd is the only known false positive.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Files dropped but never executed are not process events and are not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ (".smt", ".smtk", "smt.cmd", "sysmon.cmd") or ProcessCommandLine matches regex @"(?i)(\.config.\.smtk?\b|(?:\.)config.smt\.cmd|sysmon\.cmd|\.stk_[0-9a-f]{10}|@reboot.*\.smt)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Cursor-family process connecting on TCP 8099 or to an external SSH port
// MITRE: T1071.001, T1572
// CONF: medium  FP: medium  COST: low
// REQUIRES: outbound network connection events (IPv4); ContextBaseFileName must carry the Cursor process name
// FALSE POSITIVES: Remote-SSH sessions to sanctioned hosts; developer tooling that listens on 8099 locally
// TUNING: exclude your sanctioned SSH destinations (RemoteAddressIP4) for the port 22 branch; baseline local 8099 listeners for two weeks before alerting on loopback hits
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^cursor/i
| (RemotePort=8099 or RemotePort=22)
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "169.254.0.0/16"])
| table([@timestamp, event_platform, ComputerName, aid, ContextBaseFileName, RemoteAddressIP4, RemotePort])

event.type = 'IP Connect' src.process.name = *
| limit 5
| columns event.time, src.process.name, dst.ip.address, dst.port.number

// HUNT: Cursor-family process connecting on TCP 8099 or to an external SSH port
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1572
// CONF: medium | FP: medium
// FALSE POSITIVES: Remote-SSH sessions to sanctioned hosts; developer tooling that listens on 8099 locally
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a Cursor-family process making an outbound IPv4 connection on TCP 8099 or 22 to a destination outside the RFC1918 and link-local ranges. On an IP Connect event the acting process is src.process.*. Loopback is not excluded, matching the CQL.
// REQUIRES: SentinelOne Deep Visibility network events (event.type IP Connect) with the connecting process name
// TUNING: Exclude sanctioned SSH destinations (dst.ip.address) for the port 22 branch; baseline local 8099 listeners for two weeks before alerting on loopback hits.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No data tables or lookups required; set the console time picker to the lookback.
// KNOWN GAPS: IPv6 destinations are not excluded by the private-range tests and are matched on port alone.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' and src.process.name matches '^cursor.*' and (dst.port.number = 8099 or dst.port.number = 22) and !(net_rfc1918(dst.ip.address)) and !(net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| columns event.time, endpoint.name, src.process.name, dst.ip.address, dst.port.number
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: Cursor-family process connecting on TCP 8099 or to an external SSH port
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1572
// CONF: medium | FP: medium
// FALSE POSITIVES: Remote-SSH sessions to sanctioned hosts; developer tooling that listens on 8099 locally
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a Cursor-family process making an outbound IPv4 connection on TCP 8099 or 22 to a destination outside the RFC1918 and link-local ranges. The connecting process is InitiatingProcessFileName and startswith is case-insensitive. Loopback is not excluded, matching the CQL.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents) with the initiating process
// TUNING: Exclude sanctioned SSH destinations (RemoteIP) for the port 22 branch; baseline local 8099 listeners for two weeks before alerting on loopback hits.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: IPv6 destinations are not covered, matching the IPv4-only CQL.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName startswith "cursor"
| where RemotePort in (8099, 22)
| where not(ipv4_is_private(RemoteIP)) and not(ipv4_is_in_range(RemoteIP, "169.254.0.0/16"))
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: Windows scheduled task named SysMon or running smt.cmd
// MITRE: T1053.005, T1036.004
// CONF: medium  FP: medium  COST: low
// REQUIRES: ScheduledTaskRegistered events (Windows). ⚠ validate in tenant: TaskName, TaskExecutable and TaskAuthor population varies by sensor version
// FALSE POSITIVES: monitoring software that registers a task named SysMon
// TUNING: exclude tasks whose TaskExecutable resolves to your approved monitoring agent path; keep the smt.cmd branch unfiltered
#event_simpleName=ScheduledTaskRegistered
| (TaskName=/^\\?SysMon$/i or TaskExecutable=/smt\.cmd/i)
| table([@timestamp, ComputerName, aid, TaskName, TaskExecutable, TaskAuthor])

event.type = 'Process Creation'
| limit 5
| columns event.type

// HUNT: Windows scheduled task named SysMon or running smt.cmd
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005, T1036.004
// CONF: medium | FP: medium
// FALSE POSITIVES: monitoring software that registers a task named SysMon
// EQUIVALENCE: unsupported-without-redesign - The CQL reads a scheduled-task registration event with the task name and executable as fields. The SentinelOne field model here attests no scheduled-task event type or task fields, so any PowerQuery would hunt unproven field names and read as a clean estate.
// REQUIRES: A SentinelOne task-registration event with attested task name and action fields, confirmed on the tenant
// TUNING: Use the CQL tab for this card; Q3 covers the schtasks create command line for the SysMon name.
// LOOKBACK: 7d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: SentinelOne cannot show the registered task name and executable from this card until the task event fields are confirmed on a tenant.
// VALIDATION LEVEL: static-reviewed

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "ScheduledTaskCreated"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: Windows scheduled task named SysMon or running smt.cmd
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005, T1036.004
// CONF: medium | FP: medium
// FALSE POSITIVES: monitoring software that registers a task named SysMon
// EQUIVALENCE: equivalent-with-schema-assumptions - Same intent on the Defender scheduled-task action: a task whose name is SysMon with an optional leading backslash, or whose recorded task details name smt.cmd. The task name is read from AdditionalFields; the executable is matched anywhere in that same field because no separate executable column is documented.
// REQUIRES: Defender for Endpoint scheduled-task telemetry (DeviceEvents with ActionType ScheduledTaskCreated) on Windows devices
// TUNING: Exclude tasks whose recorded details resolve to your approved monitoring agent path; keep the smt.cmd branch unfiltered.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The task author is not available as a column and is not shown. If AdditionalFields omits the task action on your tenant, the smt.cmd branch returns nothing.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "ScheduledTaskCreated"
| extend TaskName = tostring(parse_json(AdditionalFields).TaskName)
| where TaskName matches regex @"(?i)^\\?SysMon$" or AdditionalFields contains "smt.cmd"
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, TaskName, AdditionalFields, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Process launched from an affected Claude Code extension folder (exposure lead)
// MITRE: T1195.002
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with image path and command line. Partial inventory only: fires only if the extension starts a binary
// FALSE POSITIVES: the clean Open VSX 2.1.312 build shares the folder name anthropic.claude-code-2.1.312-*
// TUNING: treat 2.1.313 as exposed; for 2.1.312 confirm the install came from Cursor's marketplace (not Open VSX) and check extension.js for 134.209.82.225 and svc-telemetry
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (ImageFileName=/anthropic\.claude-code-2\.1\.31[23]-/i or CommandLine=/anthropic\.claude-code-2\.1\.31[23]-/i)
| groupBy([aid, ComputerName], function=[count(as=Hits), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect([ImageFileName])])
| table([ComputerName, aid, Hits, FirstSeen, LastSeen, ImageFileName])

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, agent.uuid, endpoint.name, tgt.process.image.path, tgt.process.cmdline

// HUNT: Process launched from an affected Claude Code extension folder (exposure lead)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1195.002
// CONF: medium | FP: medium
// FALSE POSITIVES: the clean Open VSX 2.1.312 build shares the folder name anthropic.claude-code-2.1.312-*
// EQUIVALENCE: approximate-analytic - Same population and grouping: process creations whose image path or command line names an affected extension folder, counted per host with first and last seen. The CQL collects every image path; PowerQuery has no collect aggregate in the offline engine, so one example path is returned with any().
// REQUIRES: SentinelOne Deep Visibility process-creation events with image path and command line
// TUNING: Treat 2.1.313 as exposed; for 2.1.312 confirm the install came from the Cursor marketplace rather than Open VSX before escalating.
// LOOKBACK: 30d; this is an exposure lead and the extension may have run well before the disclosure
// CONFIGURATION: No data tables or lookups required; set the console time picker to the lookback.
// KNOWN GAPS: Only the first image path per host is shown. Fires only if the extension starts a binary; an extension that never launches a process leaves no event.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.image.path matches '.*anthropic\\.claude-code-2\\.1\\.31[23]-.*' or tgt.process.cmdline matches '.*anthropic\\.claude-code-2\\.1\\.31[23]-.*')
| group hits=count(), first_seen=min(event.time), last_seen=max(event.time), image_path=any(tgt.process.image.path) by agent.uuid, endpoint.name
| sort -hits
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, FolderPath, ProcessCommandLine
| take 5

// HUNT: Process launched from an affected Claude Code extension folder (exposure lead)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1195.002
// CONF: medium | FP: medium
// FALSE POSITIVES: the clean Open VSX 2.1.312 build shares the folder name anthropic.claude-code-2.1.312-*
// EQUIVALENCE: equivalent-with-schema-assumptions - Same population and grouping: process creations whose image path or command line names an affected extension folder, counted per device with first and last seen and the distinct image paths.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Treat 2.1.313 as exposed; for 2.1.312 confirm the install came from the Cursor marketplace rather than Open VSX before escalating.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Fires only if the extension starts a binary; an extension that never launches a process leaves no event.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FolderPath matches regex @"(?i)anthropic\.claude-code-2\.1\.31[23]-" or ProcessCommandLine matches regex @"(?i)anthropic\.claude-code-2\.1\.31[23]-"
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), ImagePaths = make_set(FolderPath, 10) by DeviceId, DeviceName
| sort by LastSeen desc
| take 200