OpenClaw Malicious Skill Download and Execute
Detects when a known OpenClaw AI agent process spawns a shell to download and immediately execute a script. This is a common pattern used by malicious "Skills" to establish persistence or run further payloads, as detailed in the NSFOCUS report.
Microsoft Sentinel (KQL)
