OpenClaw Clawd install.sh Download via curl wget PowerShell or LOLBins

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•6•0•43

This rule detects the execution of specific download utilities (curl, wget, aria2c, fetch, PowerShell, certutil, bitsadmin, mshta) attempting to download 'install.sh' from either 'clawd.bot' or 'openclaw.ai'. This activity is indicative of potential malware or unauthorized script downloads, possibly bypassing network security controls.