Clawdbot Payload Staging In Temp Directory
Detects the creation of executable files (.exe, .dll) in the `%TEMP%\Lightshot` directory. This directory is used as a staging area by the malicious fake Clawdbot VS Code extension to drop its payloads, including a weaponized ScreenConnect client.
YARA-L
