OpenClawCLI Malicious Infrastructure Network Connection
This rule detects network connections to domains and IP addresses associated with the malicious OpenClawCLI campaign, which uses social engineering to trick users into running obfuscated commands.
Microsoft Sentinel (KQL)
