Scott Phillips
@Carepanda10Completionist
2 followers5 downloads37 copies0 likes505 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
Platforms
2
1
Products / Services
2
1
MITRE Techniques
1
1
1
This detection identifies potentially malicious SSH tunneling activity initiated by OpenClaw‑derived AI agents, including earlier variants such as Clawdbot and Moltbot. OpenClaw is known to operate with extensive access to the underlying operating system and command‑line interface, creating opportunities for misuse when vulnerable or misconfigured. Instances of OpenClaw have been shown to expose sensitive automation capabilities, making them a high‑risk launching point for unauthorized system‑level actions.
The rule specifically looks for SSH or Plink processes executed with tunneling or proxying flags (such as -L, -R, -D, -oProxyCommand, and similar switches commonly associated with port forwarding, lateral movement, credential exfiltration, covert channels, and SOCKS proxy creation). When these commands originate from OpenClaw, Clawdbot, or Moltbot processes, it may indicate that an AI agent has been compromised or repurposed to establish unauthorized remote access pathways.
The rule specifically looks for SSH or Plink processes executed with tunneling or proxying flags (such as -L, -R, -D, -oProxyCommand, and similar switches commonly associated with port forwarding, lateral movement, credential exfiltration, covert channels, and SOCKS proxy creation). When these commands originate from OpenClaw, Clawdbot, or Moltbot processes, it may indicate that an AI agent has been compromised or repurposed to establish unauthorized remote access pathways.
This detection identifies the execution of SyncAppvPublishingServer.vbs—a legitimate Microsoft App‑V script—when launched under wscript.exe or cscript.exe, which is abnormal outside of App‑V environments. Although the script is signed by Microsoft and intended to support application publishing workflows, threat actors have increasingly adopted it as a LOLScript-based execution proxy. By invoking this script directly and supplying crafted arguments, adversaries can cause it to spawn PowerShell or run additional commands on their behalf, often without ever calling powershell.exe explicitly. This evasion is highly effective against visibility controls that rely on direct process-name monitoring.
This rule detects the connection of specific USB devices that are commonly associated with IP KVM (Keyboard, Video, Mouse) devices. It identifies these devices by checking the 'Manufacturer' field for 'PiKVM' or 'tinypilot', the 'vendorid' for a specific hexadecimal string ('6b65796d696d6670690'), or the 'SerialNumber' for 'CAFEBABE'. The rule monitors various USB device connection events such as 'USBDeviceConnected', 'UsbDriveMounted', 'UsbDriveUnmounted', 'UsbDeviceDisconnected', 'DeviceDisplayConnected', and 'PnpDeviceConnected' within 'DeviceEvents'. The presence of such devices can indicate remote access or potential compromise, as IP KVMs allow network-based control of a computer.