Potential OpenClaw Installation via Node.js or Direct URL
This rule detects the execution of 'node' with 'install' and 'openclaw' in its command line, or any process command line containing 'https://openclaw.ai/install.'. This indicates an attempt to install or execute the 'openclaw' tool, potentially for malicious purposes or unauthorized software deployment.
Microsoft Sentinel (KQL)
