Crowdstrike CQL - Suspicious Network Connection by Clawbot/Moltbot/Openclaw

Leo Arm@WhatDoesKmean

•updated Mar 4, 2026•26•1•433

This rule detects network connections initiated by specific executables (clawdbot, node, moltbot, openclaw) from a local port (18789, 3000, or 8080) to a remote IP address that is not localhost, not within private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), and not within the 17.0.0.0/8 CIDR block. This could indicate command and control (C2) communication or unauthorized data exfiltration by potentially malicious bots or applications.