OpenClaw - OS Profiling Sub-Processes (T1082)
This rule detects Python spawning native OS command utilities such as 'systeminfo.exe', 'whoami.exe', and 'ipconfig.exe'. The detection logic specifically looks for at least two distinct reconnaissance commands executed by the same Python process within a one-minute window, indicating potential victim profiling for a C2 panel, as observed in OpenClaw campaigns.
Microsoft Sentinel (KQL)
