OpenClaw Domain Resolution
This rule detects DNS lookups to domains associated with OpenClaw, Moltbot, or Clawdbot infrastructure. It specifically looks for DNS requests containing "clawhub.ai", "openclaw.ai", "open-claw.me", "molt.bot", "openclaw.bot", "onlycrabs.ai", "moltbook.com", or "thecolony.cc". To reduce noise, it excludes DNS requests originating from known mail or DNS resolver processes such as "perl", "surgemail", "named", "smtpd", "MailService", "pdns_recursor", "unbound", "systemd-resolved", "MailEnable SMTP Connector", and "opendkim".
Microsoft Sentinel (KQL)
