Execution via OpenClaw Agent

  1[metadata]
  2creation_date = "2026/02/02"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects suspicious child process execution from the OpenClaw, Moltbot, or Clawdbot AI coding agents running via Node.js.
 11These tools can execute arbitrary shell commands through skills or prompt injection attacks. Malicious skills from
 12public registries like ClawHub have been observed executing obfuscated download-and-execute commands targeting
 13cryptocurrency wallets and credentials. This rule identifies shells, scripting interpreters, and common LOLBins spawned
 14by these AI agents.
 15"""
 16from = "now-9m"
 17index = ["logs-endpoint.events.process-*"]
 18language = "eql"
 19license = "Elastic License v2"
 20name = "Execution via OpenClaw Agent"
 21note = """## Triage and analysis
 22
 23### Investigating Execution via OpenClaw Agent
 24
 25OpenClaw (formerly Clawdbot, rebranded to Moltbot) is a personal AI coding assistant that can execute shell commands 
 26and scripts on behalf of users. Malicious actors have weaponized the skill ecosystem (ClawHub) to distribute skills 
 27that execute download-and-execute commands, targeting cryptocurrency wallets and credentials.
 28
 29### Possible investigation steps
 30
 31- Verify if OpenClaw/Moltbot is an approved application in your organization.
 32- Review the child process command line for indicators of malicious activity (encoded payloads, remote downloads, credential access).
 33- Check the parent Node.js process command line to identify which OpenClaw component initiated the execution.
 34- Examine recently installed skills from ClawHub for malicious or obfuscated code.
 35- Correlate with network events to identify data exfiltration or C2 communication.
 36- Review the user's AI conversation history for prompt injection attempts.
 37
 38### False positive analysis
 39
 40- Developers legitimately using OpenClaw/Moltbot for AI-assisted coding may trigger this rule when the AI executes build scripts, curl commands, or other legitimate automation.
 41- If the tool is approved, consider tuning based on specific command patterns or adding exception lists.
 42
 43### Response and remediation
 44
 45- If the child process activity appears malicious, terminate the OpenClaw gateway and investigate the skill that initiated the command.
 46- Review and remove any suspicious skills from the OpenClaw configuration.
 47- If credentials may have been accessed, rotate affected secrets and API keys.
 48- Block known typosquat domains (moltbot.you, clawbot.ai, clawdbot.you) at the network level.
 49"""
 50references = [
 51    "https://www.malwarebytes.com/blog/threat-intel/2026/01/clawdbots-rename-to-moltbot-sparks-impersonation-campaign",
 52    "https://www.tomshardware.com/tech-industry/cyber-security/malicious-moltbot-skill-targets-crypto-users-on-clawhub",
 53    "https://blogs.cisco.com/ai/personal-ai-agents-like-openclaw-are-a-security-nightmare",
 54    "https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html",
 55]
 56risk_score = 47
 57rule_id = "a7c3e8f2-4b19-4d6a-9e5c-8f1a2b3c4d5e"
 58severity = "medium"
 59tags = [
 60    "Domain: Endpoint",
 61    "Domain: GenAI",
 62    "OS: Linux",
 63    "OS: macOS",
 64    "OS: Windows",
 65    "Use Case: Threat Detection",
 66    "Tactic: Execution",
 67    "Tactic: Command and Control",
 68    "Data Source: Elastic Defend",
 69    "Resources: Investigation Guide",
 70    "Noise: High",
 71    "Performance: Normal",
 72    "Profile: Aggressive",
 73    "Threat: Living off the Land",
 74    "Rule Type: Event Correlation (EQL)",
 75    "Platform: Windows",
 76    "Platform: Linux",
 77    "Platform: macOS",
 78    "Mitre Atlas: AML.T0053",
 79    "Mitre Atlas: AML.T0108",
 80]
 81timestamp_override = "event.ingested"
 82type = "eql"
 83
 84query = '''
 85process where event.type == "start" and
 86  process.parent.name : ("node", "node.exe") and 
 87  process.parent.command_line : ("*openclaw*", "*moltbot*", "*clawdbot*") and
 88   process.name : ("bash", "sh", "zsh", "bash.exe", "cmd.exe", "powershell.exe", "curl.exe", "curl", "base64", "xattr", "osascript", "python*", "chmod", "certutil.exe", "rundll32.exe") and
 89   not process.args in (
 90     "ip neigh show",
 91     "arp -a -n -l",
 92     "ip neighbor show dev wlan0",
 93     "ip neighbor show dev eth0",
 94     "arp -a | findstr /C:---"
 95   )
 96'''
 97
 98
 99[[rule.threat]]
100framework = "MITRE ATT&CK"
101[[rule.threat.technique]]
102id = "T1059"
103name = "Command and Scripting Interpreter"
104reference = "https://attack.mitre.org/techniques/T1059/"
105[[rule.threat.technique.subtechnique]]
106id = "T1059.001"
107name = "PowerShell"
108reference = "https://attack.mitre.org/techniques/T1059/001/"
109
110[[rule.threat.technique.subtechnique]]
111id = "T1059.002"
112name = "AppleScript"
113reference = "https://attack.mitre.org/techniques/T1059/002/"
114
115[[rule.threat.technique.subtechnique]]
116id = "T1059.003"
117name = "Windows Command Shell"
118reference = "https://attack.mitre.org/techniques/T1059/003/"
119
120[[rule.threat.technique.subtechnique]]
121id = "T1059.004"
122name = "Unix Shell"
123reference = "https://attack.mitre.org/techniques/T1059/004/"
124
125[[rule.threat.technique.subtechnique]]
126id = "T1059.006"
127name = "Python"
128reference = "https://attack.mitre.org/techniques/T1059/006/"
129
130[[rule.threat.technique.subtechnique]]
131id = "T1059.007"
132name = "JavaScript"
133reference = "https://attack.mitre.org/techniques/T1059/007/"
134
135
136
137[rule.threat.tactic]
138id = "TA0002"
139name = "Execution"
140reference = "https://attack.mitre.org/tactics/TA0002/"
141[[rule.threat]]
142framework = "MITRE ATT&CK"
143[[rule.threat.technique]]
144id = "T1071"
145name = "Application Layer Protocol"
146reference = "https://attack.mitre.org/techniques/T1071/"
147[[rule.threat.technique.subtechnique]]
148id = "T1071.001"
149name = "Web Protocols"
150reference = "https://attack.mitre.org/techniques/T1071/001/"
151
152
153[[rule.threat.technique]]
154id = "T1105"
155name = "Ingress Tool Transfer"
156reference = "https://attack.mitre.org/techniques/T1105/"
157
158
159[rule.threat.tactic]
160id = "TA0011"
161name = "Command and Control"
162reference = "https://attack.mitre.org/tactics/TA0011/"
163[[rule.threat]]
164framework = "MITRE ATT&CK"
165[[rule.threat.technique]]
166id = "T1140"
167name = "Deobfuscate/Decode Files or Information"
168reference = "https://attack.mitre.org/techniques/T1140/"
169
170[[rule.threat.technique]]
171id = "T1218"
172name = "System Binary Proxy Execution"
173reference = "https://attack.mitre.org/techniques/T1218/"
174[[rule.threat.technique.subtechnique]]
175id = "T1218.011"
176name = "Rundll32"
177reference = "https://attack.mitre.org/techniques/T1218/011/"
178
179
180
181[rule.threat.tactic]
182id = "TA0005"
183name = "Defense Evasion"
184reference = "https://attack.mitre.org/tactics/TA0005/"
185[[rule.threat_mappings]]
186framework = "MITRE ATLAS"
187version = "2026.08"
188[[rule.threat_mappings.threat]]
189framework = "MITRE ATLAS"
190[[rule.threat_mappings.threat.technique]]
191id = "AML.T0053"
192name = "AI Agent Tool Invocation"
193reference = "https://atlas.mitre.org/techniques/AML.T0053/"
194
195
196[rule.threat_mappings.threat.tactic]
197id = "AML.TA0005"
198name = "Execution"
199reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
200[[rule.threat_mappings.threat]]
201framework = "MITRE ATLAS"
202[[rule.threat_mappings.threat.technique]]
203id = "AML.T0108"
204name = "AI Agent"
205reference = "https://atlas.mitre.org/techniques/AML.T0108/"
206
207
208[rule.threat_mappings.threat.tactic]
209id = "AML.TA0014"
210name = "Command and Control"
211reference = "https://atlas.mitre.org/tactics/AML.TA0014/"