Leo Arm
@WhatDoesKmean0 followers4 downloads26 copies1 like433 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
MITRE Techniques
1
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects network connections initiated by specific executables (clawdbot, node, moltbot, openclaw) from a local port (18789, 3000, or 8080) to a remote IP address that is not localhost, not within private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), and not within the 17.0.0.0/8 CIDR block. This could indicate command and control (C2) communication or unauthorized data exfiltration by potentially malicious bots or applications.
