Suspicious Activity by ClawAgents with 'clone' Keyword
This rule detects suspicious network connections or process executions initiated by processes whose command line contains specific 'ClawAgents' keywords and, in the case of process execution, also contains the keyword 'clone'. It specifically excludes known browser processes from the network connection detection to reduce false positives. The 'ClawAgents' appear to be related to a specific threat or toolset, and the 'clone' keyword suggests activities like cloning repositories or creating copies, which could be indicative of malicious operations.
Microsoft Sentinel (KQL)
