Detect OpenClaw via Email with Malicious PowerShell Script URL

Daniel Jeremiah@daniyyell

•updated Mar 17, 2026•39•0•286

This rule detects emails containing a specific URL (https://openclaw.ai/install.ps1) which is known to host a PowerShell script. This indicates a potential attempt to deliver malicious code via email, likely as part of a phishing campaign to execute the script on the recipient's system.