Fake ClawdBot VS Code Extension Dropping ScreenConnect RAT
This rule detects activity associated with the 'ClawdBot' campaign, which involves dropping the ScreenConnect Remote Access Trojan (RAT) via a fake VS Code extension. It identifies suspicious network connections to known malicious domains or Dropbox (when initiated by Code.exe), known malicious file hashes, outbound connections to ScreenConnect C2 ports, creation or start of ScreenConnect services, file drops in temporary directories related to ScreenConnect or Lightshot, and execution of Code.exe or ScreenConnect binaries from temporary folders. It also looks for initial payload downloads from attacker command and control infrastructure.
Microsoft Sentinel (KQL)
