Special Edition: Local AI Agent Discovery & Risk Hunting

Local AI agents increasingly run as ordinary endpoint processes, CLI wrappers, IDE helpers, containers, MCP clients, MCP servers, and local inference APIs. Presence alone is not malicious; the defensive goal is to establish ownership and approval, then identify behavior that crosses policy boundaries.

No atomic malicious IOCs are claimed. Product names, executable names, ports, and configuration filenames are behavioral discovery pivots, not block indicators.

Affected Surface and Telemetry

ATT&CK Mapping

T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer; T1552.001 Credentials in Files; T1560.001 Archive via Utility; T1074.001 Local Data Staging; T1053.005 Scheduled Task; T1053.003 Cron; T1543.001/.004 Launch Agent and Daemon; T1543.003 Windows Service; T1572 Protocol Tunneling; T1610 Deploy Container; T1078.002 Domain Accounts; T1083 File and Directory Discovery. Inventory-only observations use T1518.001 Security Software Discovery as the closest administrative discovery mapping and should not be interpreted as adversary attribution.

Discovery-term transparency: Codex, Claude, MCP, Ollama, and LM Studio are anchored to primary product documentation in this pack. Additional product and model names are heuristic discovery terms, not malicious indicators. Confirm ownership, path, signer, hash, and business context before escalation.

Start here: these hunts prioritize fleet inventory, high-risk tool execution, persistence, exposed model services, sensitive behavior, and wrapper lineage.

Falcon time picker: Open in Falcon starts at 7 days. Set the Falcon time picker to each card's stated lookback before interpreting an empty or partial result.

Query Review Matrix

// HUNT: Known AI agent and coding-assistant executables
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — administrative inventory
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — inventory and first-seen review
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved software-distribution paths and managed developer workstations.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|gemini|copilot|windsurf|zed|amp)(\.exe)?$/i
| groupBy([ComputerName, UserName, FileName, ImageFileName], function=[count(as=Executions), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), selectFromMax(field=@timestamp, include=[CommandLine])], limit=10000)
| sort(LastSeen, order=desc, limit=1000)
| table([LastSeen, FirstSeen, ComputerName, UserName, FileName, ImageFileName, Executions, CommandLine])

// HUNT: Local model runtimes and inference servers
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — administrative inventory
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — inventory persistent and intermittent runtimes
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude sanctioned AI lab endpoints and approved inference servers.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(ollama|lms|lm[ _-]?studio|llmster|llama-server|llama-cli|vllm|local-ai|localai|jan|gpt4all|anythingllm|msty|koboldcpp)(\.exe)?$/i
| groupBy([ComputerName, UserName, FileName, ImageFileName], function=[count(as=Executions), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), selectFromMax(field=@timestamp, include=[CommandLine])], limit=10000)
| sort(LastSeen, order=desc, limit=1000)
| table([LastSeen, FirstSeen, ComputerName, UserName, FileName, ImageFileName, Executions, CommandLine])

// HUNT: MCP server launch through npx
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1059.007
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 30d — MCP servers can be short-lived
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Allowlist approved MCP package names and expected parent clients.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(npx|npm|node)(\.exe)?$/i
| CommandLine = /(@modelcontextprotocol\/|mcp-server-|modelcontextprotocol\/inspector|\bmcp\b.*\bserver\b)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: MCP server launch through uvx or Python
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1059.006
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 30d — Python MCP servers are often ephemeral
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Allowlist approved server modules, virtual environments, and parent AI clients.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(uvx|uv|python|python3)(\.exe)?$/i
| CommandLine = /(mcp[-_ ]server|fastmcp|modelcontextprotocol|\bmcp\s+run\b)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Codex or Claude MCP operations and server mode
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1059
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — explicit server modes are strong inventory signals
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: No default exclusion; confirm the owning user and approved integration.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(codex|claude)(\.exe)?$/i
| CommandLine = /(mcp-server|\bmcp\s+(add|serve|list|get)\b|--mcp-config)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: AI agent spawning command shells
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1059.001,T1059.003,T1059.004
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 14d — direct tool execution is higher-signal
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude documented IDE terminal workflows and signed enterprise automation after parent validation.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter|ollama|lm[ _-]?studio)(\.exe)?$/i
| FileName = /^(cmd|powershell|pwsh|bash|sh|zsh|wsl)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: AI agent spawning tunneling software
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1572
// CONF: high
// FP: low
// COST: medium
// TIMEFRAME: 14d — tunnels may expose local services externally
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Allowlist sanctioned remote-development gateways and documented support sessions.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter|ollama|lm[ _-]?studio)(\.exe)?$/i
| FileName = /^(ngrok|cloudflared|frpc|chisel|tailscale|ssh)(\.exe)?$/i
| CommandLine = /(tunnel|--url|--remote|\s-[RL]\s*\S|serve|funnel)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Agent command lines targeting credential and secret paths
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1552.001
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 14d — secret discovery warrants rapid review
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude authorized secrets-scanning jobs and approved developer security tooling.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| CommandLine = /(\.ssh[\\\/]|\.aws[\\\/]|\.azure[\\\/]|\.kube[\\\/]|\.env\b|credentials|id_rsa|known_hosts|keychain|login\.json|config\.toml)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: AI agent creating Windows scheduled tasks
// MODE: Persistence hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1053.005
// CONF: high
// FP: low
// COST: medium
// TIMEFRAME: 30d — persistence is uncommon for normal assistants
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved endpoint-management task names after verifying the parent chain.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| FileName = /^(schtasks|powershell|pwsh)(\.exe)?$/i
| CommandLine = /(\/create|Register-ScheduledTask|New-ScheduledTask)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: AI agent creating persistent services
// MODE: Persistence hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1543.002,T1543.003,T1053.003,T1543.001,T1543.004
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 30d — service changes can establish privileged persistence
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved software installers only after confirming binary path and service owner.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| FileName = /^(sc|systemctl|crontab|launchctl)(\.exe)?$/i
| CommandLine = /(\bsc(\.exe)?\s+(create|config)\b|\bsystemctl\s+enable\b|\bcrontab\b|\blaunchctl\s+(load|bootstrap)\b)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Persistence registry values referencing agent runtimes
// MODE: Persistence hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1547.001
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — direct persistence artifact
// REQUIRES: AsepValueUpdate / RegGenericValueUpdate
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved per-user startup entries after validating signer, path, and owner.
#event_simpleName = /AsepValueUpdate|RegGenericValueUpdate/
| RegObjectName = /(CurrentVersion\\Run|CurrentVersion\\RunOnce|Policies\\Explorer\\Run)/i
| RegStringValue = /(\b(codex|claude|cursor|aider|goose|opencode|cline|roo|ollama|lm[ _-]?studio)\b|python.*agent|node.*mcp)/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Ollama or LM Studio listener exposed beyond loopback
// MODE: Exposure hunt
// REVIEW STATUS: Tenant validation
// LINEAGE: PID join; narrow time pivot
// TENANT VALIDATION: Narrow to a host and time range; confirm field and event coverage before operational use.
// MITRE: N/A — exposure inventory
// CONF: high
// FP: low
// COST: medium
// TIMEFRAME: 7d — exposed APIs can permit unintended access
// REQUIRES: NetworkListenIP4 plus process correlation
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude explicitly approved, authenticated inference servers after network-owner review.
#event_simpleName = NetworkListenIP4
| LocalPort = /^(11434|1234)$/
| LocalAddressIP4 != "127.0.0.1"
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/ | FileName = /^(ollama|lms|lm[ _-]?studio|llmster)(\.exe)?$/i}, field=[aid, TargetProcessId_decimal], include=[FileName, ImageFileName, CommandLine, UserName], mode=inner)
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, LocalAddressIP4, LocalPort, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Agent or model runtime receiving non-loopback connections
// MODE: Exposure hunt
// REVIEW STATUS: Tenant validation
// LINEAGE: PID join; narrow time pivot
// TENANT VALIDATION: Narrow to a host and time range; confirm field and event coverage before operational use.
// MITRE: N/A — exposure inventory
// CONF: medium
// FP: medium
// COST: high
// TIMEFRAME: 7d — identifies network-reachable local services
// REQUIRES: NetworkReceiveAcceptIP4 plus process correlation
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved server VLANs and authenticated inference services; prioritize workstations.
#event_simpleName = NetworkReceiveAcceptIP4
| RemoteAddressIP4 != "127.0.0.1"
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/ | FileName = /^(codex|claude|ollama|lms|lm[ _-]?studio|llmster|vllm|localai)(\.exe)?$/i}, field=[aid, TargetProcessId_decimal], include=[FileName, ImageFileName, CommandLine, UserName], mode=inner)
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, LocalAddressIP4, LocalPort, RemoteAddressIP4, RemotePort, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: IDE-managed local MCP server subprocesses
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1059
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 30d — MCP subprocesses may run only during a session
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved MCP extensions and workspace tools
// TUNING: Allowlist server command, package, workspace, parent editor, and expected user together.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(code|code-insiders|cursor|windsurf|kiro|vscodium)(\.exe)?$/i
| FileName = /^(npx|node|python|python3|uv|uvx|docker|podman|java|dotnet)(\.exe)?$/i
| CommandLine = /(mcp[-_ ]server|modelcontextprotocol|fastmcp|@modelcontextprotocol|\bmcp\b)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: MCP configuration command-line references
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — administrative inventory
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — configuration establishes local tool access
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: authorized MCP onboarding
// TUNING: Confirm the server definition, workspace trust, authentication method, and business owner.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| CommandLine = /(--add-mcp|\.vscode[\\\/]mcp\.json|\.cursor[\\\/]mcp\.json|\.mcp\.json|--mcp-config|mcp\s+add)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: WSL launching agents or model runtimes
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1059.004
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 30d — Windows wrappers may hide Linux-side execution
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved development inside WSL
// TUNING: Baseline approved WSL distributions, users, repositories, and agent commands.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^wsl(\.exe)?$/i
| CommandLine = /\b(codex|claude|gemini|qwen|aider|goose|opencode|cline|roo|continue|openhands|ollama|llama-server|vllm|localai|mcp[-_ ]server)\b/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Agent-driven host or network discovery
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1046,T1082
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 14d — autonomous discovery may cross the intended workspace
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved diagnostics and security testing
// TUNING: Exclude documented diagnostic playbooks and security-team endpoints; prioritize broad or repeated scans.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| FileName = /^(nmap|masscan|systeminfo|nltest|dsquery|ipconfig|ifconfig|netstat|ss)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Agent-spawned encoded or hidden PowerShell
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1059.001,T1027
// CONF: high
// FP: low
// COST: medium
// TIMEFRAME: 14d — encoding or hidden execution is unusual for transparent agent work
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved automation frameworks that encode PowerShell payloads
// TUNING: Decode and validate the payload; exclude only signed, documented automation after review.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| FileName = /^(powershell|pwsh)(\.exe)?$/i
| CommandLine = /(-enc(odedcommand)?\s+|-windowstyle\s+hidden|-w\s+hidden|frombase64string)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Agent-spawned destructive file or repository commands
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1070.004,T1485
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 14d — autonomous destructive actions require rapid validation
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved build cleanup, test teardown, and repository maintenance
// TUNING: Exclude narrow known cleanup paths; never globally suppress broad recursive deletion or forced resets.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| CommandLine = /(rm\s+(-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*|--recursive\s+--force|--force\s+--recursive)|Remove-Item.*(-Recurse.*-Force|-Force.*-Recurse)|(del|rmdir)\s+.*(\/s.*\/q|\/q.*\/s)|git\s+reset\s+--hard|git\s+clean\s+-[a-z]*f[a-z]*)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Risky child tools through agent wrapper processes
// MODE: Behavior hunt
// REVIEW STATUS: Tenant validation
// LINEAGE: One wrapper generation
// TENANT VALIDATION: Narrow to a host and time range; confirm field and event coverage before operational use.
// MITRE: T1059,T1105,T1572
// CONF: medium
// FP: medium
// COST: high
// TIMEFRAME: 14d — closes the direct-parent blind spot for one wrapper generation
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 with PID correlation
// FALSE POSITIVES: approved IDE terminals, build systems, package managers, and test automation
// TUNING: Require the joined wrapper command to identify an agent package; baseline approved users and workspaces.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(cmd|powershell|pwsh|bash|sh|curl|wget|ssh|scp|rclone|ngrok|cloudflared|chisel)(\.exe)?$/i
| rename(field=ParentProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/ | FileName = /^(node|python|python3|npx|npm|uv|uvx|code|cursor|wsl)(\.exe)?$/i | CommandLine = /\b(codex|claude-code|gemini-cli|qwen-code|aider|goose|opencode|cline|roo|continue|openhands|mcp[-_ ]server)\b/i | rename(field=FileName, as=AgentWrapper) | rename(field=CommandLine, as=AgentWrapperCommand)}, field=[aid, TargetProcessId_decimal], include=[AgentWrapper, AgentWrapperCommand], mode=inner)
| table([@timestamp, ComputerName, UserName, AgentWrapper, AgentWrapperCommand, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

Extended coverage: run these for deeper inventory, model and package attribution, file activity, containers, WSL, browser automation, and tenant-specific pivots. High-cost hunts should remain analyst-driven until measured.

Query Review Matrix

// HUNT: AI agent unrestricted or permission-bypass modes
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — policy-risk behavior
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — identifies reduced human-control safeguards
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: isolated test sandboxes and explicitly approved automation
// TUNING: Exclude only documented isolated hosts with compensating controls and a named owner.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ((FileName = /^(codex|claude|gemini|qwen|copilot|aider|goose|amp|q)(\.exe)?$/i) or ((FileName = /^(node|npx|python|python3|bun|bunx)(\.exe)?$/i) and (CommandLine = /(@openai\/codex|@anthropic-ai\/claude-code|@google\/gemini-cli|@github\/copilot|@qwen-code\/qwen-code|@sourcegraph\/amp)/i)))
| CommandLine = /(--dangerously-skip-permissions|--permission-mode\s+bypassPermissions|--sandbox\s+danger-full-access|--dangerously-bypass-approvals-and-sandbox|--ask-for-approval\s+never|--approval-policy\s+never|approval_policy\s*=\s*never|--approval-mode\s+yolo|--full-auto|--yolo|--auto-approve|--yes-always|--allow-all-tools|--trust-all-tools|--dangerously-allow-all)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: CLI package names launched through Node.js or npm
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1059.007
// CONF: medium
// FP: medium
// COST: medium
// TIMEFRAME: 30d — catches wrapper-based installations
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved package-manager automation and developer build hosts.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(node|npm|npx)(\.exe)?$/i
| CommandLine = /(@openai\/codex|@anthropic-ai\/claude-code|@modelcontextprotocol|\baider\b|\bopencode\b|\bgoose\b|\bcline\b)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Python-based agent frameworks and assistants
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1059.006
// CONF: medium
// FP: high
// COST: medium
// TIMEFRAME: 30d — broad discovery for Python agents
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Baseline approved virtual environments, automation accounts, notebooks, and orchestration servers.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(python|python3|pip|pip3|pipx|uv|uvx)(\.exe)?$/i
| CommandLine = /\b(aider|autogen|crewai|langgraph|langchain|smolagents|open-interpreter|openhands|agent-zero|browser-use|mcp[-_ ]server)\b/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Containerized local AI or agent workloads
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1610
// CONF: medium
// FP: medium
// COST: medium
// TIMEFRAME: 30d — containers may hide the host process name
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved container hosts, image registries, and ML platform namespaces.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(docker|podman|nerdctl)(\.exe)?$/i
| CommandLine = /(ollama\/ollama|lm[ _-]?studio|localai|vllm|text-generation-webui|open-webui|openhands|agent-zero|langchain|crewai)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: AI agent spawning download utilities
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1105
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 14d — tool-driven transfer may introduce code or data
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved dependency retrieval and known internal artifact repositories.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| FileName = /^(curl|wget|certutil|bitsadmin|aria2c)(\.exe)?$/i
| CommandLine != /(localhost|127\.0\.0\.1)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: AI agent spawning remote-access or transfer tools
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1021.004,T1048
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 14d — remote operations can cross trust boundaries
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved repository operations and managed deployment workflows.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| FileName = /^(ssh|scp|sftp|rsync|rclone|pscp|plink)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Agent-driven environment and token discovery
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1082,T1552.001
// CONF: medium
// FP: high
// COST: medium
// TIMEFRAME: 14d — common but useful when correlated
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude expected build, CI, and developer bootstrap activity; prioritize unusual users and servers.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| CommandLine = /(set\s*$|printenv|env\s*$|Get-ChildItem\s+Env:|ANTHROPIC_API_KEY|OPENAI_API_KEY|AZURE_CLIENT_SECRET|AWS_SECRET_ACCESS_KEY|GITHUB_TOKEN)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Agent-driven archive and data staging
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1560.001,T1074.001
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 14d — staging can precede upload or model ingestion
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved release packaging and backup activity; prioritize temp, public, and user-profile outputs.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| FileName = /^(7z|7za|rar|tar|zip|makecab|powershell|pwsh)(\.exe)?$/i
| CommandLine = /(Compress-Archive|\.zip\b|\.7z\b|\btar\s|\brar\s|\bmakecab\b)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Repository or broad-root enumeration by an agent
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1083
// CONF: medium
// FP: high
// COST: medium
// TIMEFRAME: 14d — useful for spotting overly broad workspace access
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Baseline normal repository roots and exclude approved indexing operations.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| CommandLine = /(Get-ChildItem|find\s+|dir\s+\/s|rg\s+--files|git\s+(status|log|ls-files)).*(C:\\|\/home\/|\/srv\/|\/opt\/)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Distinctive local AI API port inventory
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — administrative inventory
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 7d — current service exposure snapshot
// REQUIRES: NetworkListenIP4
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Confirm LocalAddressIP4 binding; allowlist sanctioned inference endpoints and documented ports.
#event_simpleName = NetworkListenIP4
| LocalPort = /^(11434|1234|4891|1337|5001)$/
| groupBy([ComputerName, LocalAddressIP4, LocalPort, ContextBaseFileName], function=count(as=Events), limit=5000)
| sort(Events, order=desc, limit=500)
| table([ComputerName, ContextBaseFileName, LocalAddressIP4, LocalPort, Events])

// HUNT: Outbound destination baseline from known agent processes
// MODE: Exposure hunt
// REVIEW STATUS: Tenant validation
// LINEAGE: PID join; narrow time pivot
// TENANT VALIDATION: Narrow to a host and time range; confirm field and event coverage before operational use.
// MITRE: N/A — network baseline
// CONF: medium
// FP: high
// COST: high
// TIMEFRAME: 7d — destination-frequency baseline; this query does not establish rarity
// REQUIRES: NetworkConnectIP4 plus process correlation
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Compare with a longer historical baseline; allowlist vendor APIs, source-control, registries, proxies, and internal gateways.
#event_simpleName = NetworkConnectIP4
| RemoteAddressIP4 != "127.0.0.1"
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/ | FileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter|ollama|lm[ _-]?studio)(\.exe)?$/i}, field=[aid, TargetProcessId_decimal], include=[FileName, ImageFileName, CommandLine, UserName], mode=inner)
| groupBy([ComputerName, UserName, FileName, RemoteAddressIP4, RemotePort], function=[count(as=Connections), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=10000)
| sort(Connections, order=desc, limit=1000)

// HUNT: Executable drops associated with AI and MCP tooling
// MODE: Inventory
// REVIEW STATUS: Tenant validation
// LINEAGE: Direct event / not applicable
// TENANT VALIDATION: Narrow to a host and time range; confirm field and event coverage before operational use.
// MITRE: N/A — software-introduction inventory
// CONF: medium
// FP: medium
// COST: medium
// TIMEFRAME: 30d — finds newly introduced runtime binaries
// REQUIRES: NewExecutableWritten / PeFileWritten / ELFFileWritten
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude signed, approved installers and managed software-cache paths after hash review.
#event_simpleName = /NewExecutableWritten|PeFileWritten|ELFFileWritten/
| TargetFileName = /\b(codex|claude|cursor|aider|goose|opencode|cline|roo|ollama|lm[ _-]?studio|llmster|mcp[-_ ]server)\b/i
| table([@timestamp, ComputerName, UserName, TargetFileName, SHA256HashData, ContextBaseFileName, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: AI agent package installation activity
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — administrative inventory
// CONF: medium
// FP: medium
// COST: medium
// TIMEFRAME: 30d — identifies bootstrap and deployment activity
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Exclude approved software deployment accounts and documented developer onboarding windows.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(npm|npx|pip|pip3|pipx|uv|winget|choco)(\.exe)?$/i
| CommandLine = /(install.*(@openai\/codex|@anthropic-ai\/claude-code|\baider\b|crewai|autogen|openhands|agent-zero|ollama|lm[ _-]?studio)|tool\s+install.*(aider|agent|mcp))/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: AI agent activity under privileged or service identities
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — policy-risk inventory
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 30d — service and privileged contexts increase impact
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Allowlist purpose-built automation identities and approved agent hosts; investigate interactive admin use.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter|ollama|lm[ _-]?studio)(\.exe)?$/i
| UserName = /^(SYSTEM|root|Administrator|LOCAL SERVICE|NETWORK SERVICE|.*\$$)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Rare AI agent executable hashes across the fleet
// MODE: Inventory
// REVIEW STATUS: Tenant validation
// LINEAGE: Direct event / not applicable
// TENANT VALIDATION: Narrow to a host and time range; confirm field and event coverage before operational use.
// MITRE: N/A — administrative inventory
// CONF: low
// FP: high
// COST: medium
// TIMEFRAME: 30d — highlights targeted or portable binaries
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned developer tools, automation, and approved AI services
// TUNING: Suppress hashes confirmed as approved releases; retain unknown paths and single-host prevalence.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter|ollama|lm[ _-]?studio)(\.exe)?$/i
| SHA256HashData = /^[A-Fa-f0-9]{64}$/
| groupBy([SHA256HashData, FileName], function=[count(as=Executions), count(aid, distinct=true, as=Hosts), collect(ImageFileName, limit=20), collect(ComputerName, limit=20), collect(UserName, limit=20)], limit=10000)
| Hosts <= 3
| sort(Hosts, order=asc, limit=1000)

// HUNT: Expanded AI coding-agent executable inventory
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — administrative inventory
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — inventory newer and less-common clients
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved developer assistants and evaluation systems
// TUNING: Exclude sanctioned tools only after recording owner, version, path, hash, and host group.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(qwen|qwen-code|gemini|kiro|amazon-q|tabby|tabby-agent|tabnine|cody|sourcegraph|openhands|open-interpreter|interpreter|agent-zero|swe-agent|mini-swe-agent|devika|mentat|plandex|pearai|void)(\.exe)?$/i
| groupBy([ComputerName, UserName, FileName, ImageFileName], function=[count(as=Executions), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), selectFromMax(field=@timestamp, include=[CommandLine])], limit=10000)
| sort(LastSeen, order=desc, limit=1000)
| table([LastSeen, FirstSeen, ComputerName, UserName, FileName, ImageFileName, Executions, CommandLine])

// HUNT: Expanded JavaScript agent package wrappers
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1059.007
// CONF: medium
// FP: medium
// COST: medium
// TIMEFRAME: 30d — wrappers can hide the product filename
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved package testing and developer onboarding
// TUNING: Exclude known package versions and managed developer hosts after validating the command line.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(npm|npx|node|bun|bunx|pnpm|pnpx|yarn)(\.exe)?$/i
| CommandLine = /(@google\/gemini-cli|qwen-code|@github\/copilot|@sourcegraph\/amp|@continuedev|\bcline\b|roo-code|openhands|open-interpreter|plandex|mentat|devika)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Product-like paths with unexpected executable names
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — heuristic inventory
// CONF: medium
// FP: high
// COST: high
// TIMEFRAME: 30d — finds portable and renamed installations
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: scripts and folders whose names mention AI products
// TUNING: Require corroboration from hash, signer, package metadata, child processes, or network behavior.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName = /(\.codex|\.claude|\.cursor|\.continue|\.cline|\.roo|\.aider|\.goose|\.opencode|gemini-cli|qwen-code|openhands|agent-zero|open-interpreter)/i
| FileName != /^(codex|claude|cursor|aider|goose|opencode|cline|roo|continue|gemini|qwen|openhands)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Expanded AI and model container images
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1610
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 30d — inventories transient and headless workloads
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned AI labs and approved inference hosts
// TUNING: Allowlist approved registries, image digests, host groups, published ports, and volume mounts.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(docker|podman|nerdctl|ctr)(\.exe)?$/i
| CommandLine = /(gemini-cli|qwen-code|openhands|open-interpreter|gpt4all|jan-ai|tabbyml|llama\.cpp|text-generation-inference|localai\/localai|vllm\/vllm-openai)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: CLI-visible model downloads through Hugging Face tooling
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: T1105
// CONF: medium
// FP: medium
// COST: medium
// TIMEFRAME: 30d — model acquisition reveals local AI use
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved ML engineering and model evaluation
// TUNING: Exclude sanctioned model repositories, service accounts, and dedicated ML hosts.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(huggingface-cli|hf|python|python3|git|git-lfs)(\.exe)?$/i
| CommandLine = /(snapshot_download|hf_hub_download|huggingface-cli\s+download|\bhf\s+download|huggingface\.co|git-lfs.*(model|gguf|safetensors))/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Local model files opened from caches
// MODE: Inventory
// REVIEW STATUS: Tenant validation
// LINEAGE: Direct event / not applicable
// TENANT VALIDATION: Narrow to a host and time range; confirm field and event coverage before operational use.
// MITRE: T1083
// CONF: medium
// FP: high
// COST: high
// TIMEFRAME: 7d — file-open telemetry can be high volume
// REQUIRES: FileOpenInfo
// FALSE POSITIVES: approved ML, analytics, and security research workloads
// TUNING: Restrict to developer workstations or servers of interest and shorten the Falcon time picker first.
#event_simpleName = FileOpenInfo
| TargetFileName = /[\\\/](huggingface|ollama|gpt4all|lm[-_ ]?studio|\.lmstudio|jan)[\\\/].*(models|blobs|cache)/i
| TargetFileName = /(\.gguf|\.safetensors|\.onnx|\.pt|\.pth|\.bin)$/i
| groupBy([ComputerName, ContextBaseFileName, TargetFileName], function=[count(as=Opens), collect(UserName, limit=20)], limit=10000)
| sort(Opens, order=desc, limit=1000)

// HUNT: Model-family names supplied to local runtimes
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — administrative inventory
// CONF: medium
// FP: medium
// COST: medium
// TIMEFRAME: 30d — attributes runtimes to model families
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved research and evaluation workloads
// TUNING: Baseline approved model families, licenses, users, and inference hosts.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(ollama|lms|lm[ _-]?studio|llama-server|llama-cli|vllm|python|python3|local-ai|localai|gpt4all|jan)(\.exe)?$/i
| CommandLine = /(llama|mistral|mixtral|qwen|deepseek|phi[-_ ]?[234]|gemma|command-r|falcon|vicuna|yi[-_ ]|starcoder|codestral|granite|gpt-oss)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Agent-spawned browser automation and remote debugging
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1059
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 14d — browser control expands an agent's accessible surface
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved UI testing, Playwright, Selenium, and developer automation
// TUNING: Allowlist known test runners, CI hosts, browser profiles, and approved parent agents.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| FileName = /^(chrome|google-chrome|google-chrome-stable|msedge|microsoft-edge|microsoft-edge-stable|chromium|chromium-browser|firefox|playwright|selenium-manager)(\.exe)?$/i
| CommandLine = /(--remote-debugging-port|--headless|playwright|selenium|user-data-dir)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Processes resolving LLM vendor and model-hub domains
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — administrative inventory
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — shadow-AI inventory independent of process naming
// REQUIRES: DnsRequest
// FALSE POSITIVES: sanctioned SDKs, telemetry, and security tooling
// TUNING: Extend the domain list per vendor mix; exclude approved hosts after ownership review.
#event_simpleName = DnsRequest
| DomainName = /^(api\.anthropic\.com|statsig\.anthropic\.com|api\.openai\.com|api\.githubcopilot\.com|generativelanguage\.googleapis\.com|openrouter\.ai|api\.mistral\.ai|api\.deepseek\.com|api\.groq\.com|api\.together\.xyz|api\.x\.ai|api\.cohere\.com|registry\.ollama\.ai|huggingface\.co|cdn-lfs\.huggingface\.co)$/i
| ContextBaseFileName != /^(chrome|msedge|firefox|safari|brave|opera|vivaldi)(\.exe)?$/i
| groupBy([ComputerName, ContextBaseFileName, DomainName], function=[count(as=Requests), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=20000)
| sort(LastSeen, order=desc, limit=2000)

// HUNT: AI agent extension installs into VS Code-family editors
// MODE: Inventory
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — administrative inventory
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — extension-hosted agents never appear as standalone executables
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved developer extension installs
// TUNING: Record owner and workspace; alert only on unapproved publisher IDs.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| CommandLine = /--install-extension[\s=]+\S*(claude-code|claude-dev|roo-cline|roo-code|continue\.continue|github\.copilot|copilot-chat|codeium|windsurf|\bcline\b|sourcegraph|tabnine|cody-ai|augment)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: AI agents launched by schedulers or service managers
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1053.005,T1053.003,T1543
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — unattended agent execution implies installed persistence or automation
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: ollama under systemd; approved unattended automation
// TUNING: Baseline approved unattended automation; investigate interactive agents under schedulers first.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(codex|claude|cursor-agent|aider|goose|opencode|gemini|qwen|openhands|interpreter|ollama|lms|lm[ _-]?studio)(\.exe)?$/i
| ParentBaseFileName = /^(svchost|taskeng|taskhostw|services|cron|crond|anacron|atd|systemd|launchd)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Hosts consuming remote local-AI API ports
// MODE: Exposure hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — exposure inventory
// CONF: medium
// FP: medium
// COST: medium
// TIMEFRAME: 7d — finds exposed model APIs from the consumer side without a join
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: approved shared inference servers and port-collision traffic
// TUNING: Validate the destination actually serves a model API; allowlist sanctioned shared endpoints.
#event_simpleName = NetworkConnectIP4
| RemotePort = /^(11434|1234|4891|1337|5001)$/
| RemoteAddressIP4 != "127.0.0.1"
| groupBy([ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=[count(as=Connections), max(@timestamp, as=LastSeen)], limit=10000)
| sort(Connections, order=desc, limit=1000)

// HUNT: Secret material in agent-spawned command lines
// MODE: Behavior hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct parent only
// MITRE: T1552.001
// CONF: high
// FP: low
// COST: medium
// TIMEFRAME: 14d — a live credential in process telemetry is already exposed
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: placeholder or documentation keys in test commands
// TUNING: Treat every hit as an exposed credential until proven placeholder; rotate on confirmation.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(codex|claude|cursor|cursor-agent|aider|goose|opencode|cline|roo|continue|windsurf|gemini|qwen|openhands|interpreter)(\.exe)?$/i
| CommandLine = /(sk-ant-[A-Za-z0-9_-]{20,}|sk-proj-[A-Za-z0-9_-]{20,}|ghp_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,}|AKIA[0-9A-Z]{16}|xox[bp]-[0-9A-Za-z-]{10,}|AIzaSy[A-Za-z0-9_-]{30,})/
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Model-runtime exposure configuration flags
// MODE: Exposure hunt
// REVIEW STATUS: Reviewed
// LINEAGE: Direct event / not applicable
// MITRE: N/A — exposure inventory
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — leading indicator for the listener exposure in Q12
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: approved shared inference servers on isolated networks
// TUNING: Confirm the bind takes effect (pivot to Q12/Q30); allowlist approved shared endpoints.
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(ollama|lms|lm[ _-]?studio|llama-server|vllm|localai|local-ai|jan|python|python3|bash|sh|zsh|cmd|powershell|pwsh)(\.exe)?$/i
| CommandLine = /(OLLAMA_HOST\s*=\s*["']?0\.0\.0\.0|--host[\s=]+["']?0\.0\.0\.0|--listen[\s=]+["']?0\.0\.0\.0|lms\s+server\s+start)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

Native Audit-Log Hunts

• Falcon Discover: inventory installed packages, unsigned/portable binaries, software owners, and host groups.
• Falcon Data Protection: review access to source, secrets, regulated data, and uploads from developer endpoints.
• Windows: audit PowerShell, scheduled-task, service, WSL, firewall, and package-manager logs.
• Linux: review systemd units, shell history, package logs, containers, listening sockets, and user crontabs.
• Proxy/DNS: baseline vendor APIs, model registries, code hosts, and unexpected external tunnels.

Custom IOA Candidates

Behavioral Quick-Copy Pivots

No atomic malicious IOCs are claimed. These are discovery pivots and behavior chains, not block indicators.

agent -> shell / downloader / remote tool
MCP client -> npx, uvx, node, or python subprocess
local model service -> non-loopback listener
agent -> persistence / secret path / archive / tunnel

codex, claude, cursor, aider, goose, opencode, cline, roo, continue, windsurf
ollama, lmstudio, llmster, vllm, localai, MCP

Detection Validation Gates

1. Confirm each event type and field is populated in a one-hour tenant sample.
2. Run inventory queries for 30 days and document approved users, hosts, hashes, paths, and parent processes.
3. Test alertable behavior with benign commands in an isolated canary endpoint.
4. Keep IOAs in Detect for at least 14 days; require measured false-positive rate below 5% before prevention consideration.
5. Review Linux and Windows separately; wrappers may obscure the true executable.

Deployable Playbooks

INVENTORY / BASELINE — NO PAGE
Scope: Q1–Q5, Q14–Q16, Q22–Q24, Q30–Q45, Q47, Q49
Cadence: daily or weekly; use each query header lookback
Disposition: record owner, approved host group, version, hash, path, listener, model and MCP server.

SCHEDULED SEARCH — HIGH-RISK AGENT BEHAVIOR
Name: HUNT: Local AI Agents - High-Risk Tool Execution
Scope: Q7–Q11, Q18–Q21, Q46, Q48 after tenant validation
Cadence: 15 minutes with 20-minute query window and 5-minute overlap
Dedup: aid + UserName + FileName + CommandLine hash for 24 hours
Suppress: approved canary/test hosts only; never suppress destructive or permission-bypass modes globally
Priority: HIGH when persistence, credential targeting, tunneling, encoded execution, or destruction is confirmed

ALERT BODY
An AI-agent or identified wrapper launched behavior outside the approved baseline. Confirm execution, parent/lineage, user, workspace and command line; then review prompts/tool logs, MCP configuration, network destinations, changed files and exposed credentials.

TRIAGE
1. Confirm ProcessRollup2 execution and record aid, ComputerName, UserName and timestamp.
2. Establish lineage with Q20 and identify the owning agent/wrapper.
3. Preserve command line, hash, signer, prompts/tool logs, MCP config and workspace diff.
4. Pivot to Q13, Q31, and Q47 for network activity and Q9–Q11, Q46 for persistence.
5. Isolate and revoke tokens when sensitive access, external exposure or destructive execution is plausible.

Containment Runbook

Reviewer caution: clean syntax and field linting do not prove live-tenant semantics. Validate each scheduled candidate on canary endpoints.

Source Review

References

• MITRE ATT&CK T1547.001 Registry Run Keys — accessed 2026-08-18
• MITRE ATT&CK T1046 Network Service Discovery — accessed 2026-08-18
• NIST AI RMF Core — accessed 2026-08-18
• OpenAI Codex README — accessed 2026-08-18
• OpenAI Codex Rust CLI README — accessed 2026-08-18
• Anthropic Claude Code CLI reference — accessed 2026-08-18
• MCP transports specification — accessed 2026-08-18
• Ollama API introduction — accessed 2026-08-18
• LM Studio server documentation — accessed 2026-08-18

Changelog