Manjunatha B M
@Mudenur0 followers40 downloads17 copies2 likes443 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
2
2
1
1
1
Platforms
2
2
1
Products / Services
1
1
1
1
1
MITRE Techniques
2
1
1
1
1
CVEs
1
1
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
Detects a pattern associated with the 'ClawHavoc' campaign where processes related to the OpenClaw AI framework download and immediately execute content from the internet. This is often seen in malicious 'prerequisite' or 'setup' scripts exploiting CVE-2026-25253.
