Emil Stahl
@emilstahlCompletionist
5 followers227 downloads75 copies9 likes1,513 views
9 detections
Filters
Last updated
All Time
Detection languages
5
3
1
Categories
3
3
2
1
1
Platforms
3
2
1
Products / Services
2
2
1
1
1
MITRE Techniques
5
5
3
3
3
Detects activity related to OpenClaw (aka Clawdbot or Moltbot) by searching for specific process command line strings, file path keywords, network listeners on port 18789, or scheduled tasks named 'OpenClaw'.
This rule detects activity related to OpenClaw, Clawdbot, and Moltbot, including their known aliases (clawd, molty, clawhub). Detection is based on several indicators: specific command-line arguments used with common scripting/execution environments (node, npm, bun, pnpm, bash, sh, zsh, launchd, env, curl, pwsh, powershell), presence of specific install or data directories (e.openclaw, .moltbot, .clawdbot, /clawd/, .molty), macOS LaunchAgent persistence mechanisms (ai.openclaw.gateway.plist, bot.molt., com.openclaw.gateway.plist, /Applications/OpenClaw.app), and the use of specific configuration file names (openclaw.json, moltbot.json, clawdbot.json, clawd.json) or aliases (molty, clawhub) within process display names or names.
This rule detects the execution of install scripts associated with 'OpenClaw' or 'Clawdbot' via various command-line interpreters. It specifically looks for commands involving 'curl', 'wget', 'bash', 'sh', 'zsh', 'pwsh', 'powershell', 'node', or 'npm' that contain specific URLs or package names related to the installation of these tools. This includes shell scripts like 'install.sh', 'install-cli.sh', PowerShell scripts like 'install.ps1', and npm installations like 'npm install -g openclaw'.
This rule detects DNS lookups to domains associated with OpenClaw, Moltbot, or Clawdbot infrastructure. It specifically looks for DNS requests containing "clawhub.ai", "openclaw.ai", "open-claw.me", "molt.bot", "openclaw.bot", "onlycrabs.ai", "moltbook.com", or "thecolony.cc". To reduce noise, it excludes DNS requests originating from known mail or DNS resolver processes such as "perl", "surgemail", "named", "smtpd", "MailService", "pdns_recursor", "unbound", "systemd-resolved", "MailEnable SMTP Connector", and "opendkim".
Detects a sequence of commands on Cisco IOS devices used to capture network traffic, specifically targeting TACACS+ on TCP port 49, and then exfiltrate it. This technique, detailed in a CISA advisory on PRC state-sponsored actors, is used to harvest credentials from network traffic.
Detects DNS queries to landing pages associated with the PDF Editor.exe & OneStart.
Detects network traffic to a list of known domains that are related to TamperedChef - PDF Editor.exe - C2 traffic.
No description available.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.