OpenClaw skill-spawned shell downloading payload then establishing OS persistenc

ills3c Intel&Coffee@Ills3C

•updated 3 days ago•0•0•0

Detects process execution where a shell (such as bash, zsh, cmd, or powershell) is spawned by a skill or openclaw process, and subsequently performs download activities (e.g., using curl, wget, invoke-webrequest) or establishes persistence (e.g., via cron, systemd, registry run keys, schtasks).