OpenClaw AI Agent Suspicious Command Execution
Detects when a known OpenClaw AI agent process executes commands associated with credential access or system discovery. This behavior can indicate a "0-click" prompt injection attack, where the agent is manipulated into executing malicious commands received through external data streams like emails or IM messages.
Microsoft Sentinel (KQL)
