Malicious ClawdBot VS Code Extension File Hash

Lacey Cochrane@NullVectorX

•updated Feb 3, 2026•2•0•57

This rule detects the presence of known malicious file hashes associated with a weaponized ScreenConnect RAT campaign, specifically targeting a fake ClawdBot VS Code extension. It monitors file and process events for these specific SHA256 hashes.