OpenClaw Install Script Execution by Content
This rule detects the execution of a bash or sh script that contains multiple identifiers related to OpenClaw installation. It specifically looks for command lines ending with '/bash' or '/sh' and containing 'openclaw', combined with additional OpenClaw-specific strings such as 'run_remote_bash', 'OPENCLAW_INSTALL_SH_NO_RUN', 'OPENCLAW_USE_GUM', 'All your chats, one OpenClaw', '.openclaw/openclaw.json', or 'openclaw.ai/install.sh'. This content-based detection aims to identify OpenClaw install script execution even if the script is renamed.
Sigma
