In 2025, an npm package asked Claude Code, Gemini CLI and Amazon Q to hunt for secrets on its behalf. Replayed in a lab: what process creation shows, two tested Sigma rules and a hunting query.
Disabling the Windows event log leaves a different trail depending on how it’s done. Eight public simulations, six log sources, two Sigma rules tested against 424,348 events, and a query to catch the silence itself.
A rule looking for "-encodedcommand" misses most of the variants. Tested on pwsh 7.6, with a validated Sigma rule, measured false positives and a triage routine.