Git Clone of Nanoclaw Repository on Claude-Related System
This rule detects the execution of a 'git clone' command to download the 'qwibitai/nanoclaw' repository, specifically on devices where a 'node' or 'node.exe' process associated with 'claude' is also observed. This could indicate an adversary installing tools or malicious code on a system potentially related to a 'claude' application or service.
Microsoft Sentinel (KQL)
