AI Agent Unusual Script Execution or Prompt Injection
This rule detects the execution of command-line interpreters (bash, powershell, cmd, python) that include commands for invoking expressions or downloading content (invoke-expression, curl, wget, Invoke-WebRequest) AND contain specific keywords associated with AI agents (moltbot, openclaw, clawdbot). This combination suggests an AI agent potentially executing arbitrary or malicious commands, possibly as a result of prompt injection or an unusual script execution scenario.
Microsoft Sentinel (KQL)
