ClawHub Malicious AI Skill Multi-Layer Obfuscated Payload Delivery
Detects anomalous HTTP responses containing high-entropy, potentially multi-layered obfuscated payloads. The rule specifically monitors for patterns suggesting Base64, ROT13, and Hex encoding in the response body, which is consistent with methods used to deliver obfuscated malicious AI skills or scripts via web traffic.
Suricata
