OpenClaw, Clawdbot, and Moltbot Runtime Activity Detection
This rule detects activity related to OpenClaw, Clawdbot, and Moltbot, including their known aliases (clawd, molty, clawhub). Detection is based on several indicators: specific command-line arguments used with common scripting/execution environments (node, npm, bun, pnpm, bash, sh, zsh, launchd, env, curl, pwsh, powershell), presence of specific install or data directories (e.openclaw, .moltbot, .clawdbot, /clawd/, .molty), macOS LaunchAgent persistence mechanisms (ai.openclaw.gateway.plist, bot.molt., com.openclaw.gateway.plist, /Applications/OpenClaw.app), and the use of specific configuration file names (openclaw.json, moltbot.json, clawdbot.json, clawd.json) or aliases (molty, clawhub) within process display names or names.
Microsoft Sentinel (KQL)
