Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
1
1
1
Platforms
1
1
Products / Services
1
1
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
This rule detects the installation and activation of the ClawdBot extension, likely within Visual Studio Code. It looks for the creation of specific files (extension.js, package.json, run.bat) within known VS Code extension paths and correlates this with the execution of 'Code.exe' or 'code.exe'. The rule specifically triggers when at least two of these files are found in the specified paths, indicating a potential extension installation.
'This hunting query identifies Zoom room systems with high CPU alerts that may be a sign of device compromise.'
