ET TROJAN OpenClaw install.sh Request clawd.bot openclaw.ai

Daniel Jeremiah@daniyyell

•updated Feb 16, 2026•1•1•86

This rule detects HTTP requests for 'install.sh' from the domains 'clawd.bot' or 'openclaw.ai'. These domains are associated with the OpenClaw/Clawd malware, indicating an attempt to download a malicious installation script.