OpenClaw Download Detected
Detects network activity consistent with a user attempting to download or install OpenClaw or a known variant — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for access to OpenClaw distribution URLs including GitHub releases, the install script endpoint, raw GitHub content, and npm registry paths for known variants. Also detects variant names appearing in process command lines at the time of a network connection, covering alternative package managers and runtimes such as Bun, pnpm, Yarn, and Deno in addition to traditional browsers and shell tools. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Microsoft Sentinel (KQL)
