[New Rule] Execution via OpenClaw Agent (#5666)

(cherry picked from commit 94c17dff59)

rules/cross-platform/command_and_control_genai_process_unusual_domain.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/12/04"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/01/08"
+updated_date = "2026/02/03"
 
 [rule]
 author = ["Elastic"]
@@ -73,13 +73,16 @@ type = "new_terms"
 
 query = '''
 event.category:network and host.os.type:macos and event.action:connection_attempted and
-process.name:(
+(
+  process.name:(
     Claude or "Claude Helper" or "Claude Helper (Plugin)" or Copilot or Cursor or
     "Cursor Helper" or "Cursor Helper (Plugin)" or GPT4All or Jan or "Jan Helper" or
     KoboldCpp or "LM Studio" or Ollama or Windsurf or "Windsurf Helper" or
     "Windsurf Helper (Plugin)" or bunx or claude or codex or copilot or cursor or deno or
     gemini-cli or genaiscript or gpt4all or grok or jan or koboldcpp or llama-cli or
     llama-server or lmstudio or npx or ollama or pnpm or qwen or textgen or windsurf or yarn
+  ) or
+  (process.name:(node or node.exe) and process.command_line:(*openclaw* or *moltbot* or *clawdbot*))
 ) and destination.domain:(* and not (
     aka.ms or anthropic.com or atlassian.com or cursor.com or cursor.sh or github.com or
     gpt4all.io or hf.co or huggingface.co or lmstudio.ai or localhost or ollama.ai or

rules/cross-platform/credential_access_genai_process_sensitive_file_access.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/12/04"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/01/08"
+updated_date = "2026/02/03"
 
 [rule]
 author = ["Elastic"]
@@ -79,22 +79,27 @@ query = '''
 file where event.action in ("open", "creation", "modification") and event.outcome == "success" and
 
   // GenAI process 
-    process.name in (
-      "ollama.exe", "ollama", "Ollama",
-      "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
-      "lmstudio.exe", "lmstudio", "LM Studio",
-      "claude.exe", "claude", "Claude",
-      "cursor.exe", "cursor", "Cursor",
-      "copilot.exe", "copilot", "Copilot",
-      "codex.exe", "codex",
-      "Jan", "jan.exe", "jan",
-      "gpt4all.exe", "gpt4all", "GPT4All",
-      "gemini-cli.exe", "gemini-cli",
-      "genaiscript.exe", "genaiscript",
-      "grok.exe", "grok",
-      "qwen.exe", "qwen",
-      "koboldcpp.exe", "koboldcpp", "KoboldCpp",
-      "llama-server", "llama-cli"
+    (
+      process.name in (
+        "ollama.exe", "ollama", "Ollama",
+        "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
+        "lmstudio.exe", "lmstudio", "LM Studio",
+        "claude.exe", "claude", "Claude",
+        "cursor.exe", "cursor", "Cursor",
+        "copilot.exe", "copilot", "Copilot",
+        "codex.exe", "codex",
+        "Jan", "jan.exe", "jan",
+        "gpt4all.exe", "gpt4all", "GPT4All",
+        "gemini-cli.exe", "gemini-cli",
+        "genaiscript.exe", "genaiscript",
+        "grok.exe", "grok",
+        "qwen.exe", "qwen",
+        "koboldcpp.exe", "koboldcpp", "KoboldCpp",
+        "llama-server", "llama-cli"
+      ) or
+      // OpenClaw/Moltbot/Clawdbot via Node.js
+      (process.name in ("node", "node.exe") and
+       process.command_line like~ ("*openclaw*", "*moltbot*", "*clawdbot*"))
     ) and
 
   // Sensitive file paths

rules/cross-platform/defense_evasion_genai_config_modification.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/12/04"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/01/08"
+updated_date = "2026/02/03"
 
 [rule]
 author = ["Elastic"]
@@ -81,7 +81,10 @@ file.path : (
     */.gemini/* or */AppData/Roaming/gemini-cli/* or
     */.grok/* or */AppData/Roaming/Grok/* or
     */.windsurf/* or */AppData/Roaming/Windsurf/* or
-    */.vscode/extensions/*mcp*
+    */.vscode/extensions/*mcp* or
+    */.openclaw/* or */AppData/Roaming/OpenClaw/* or
+    */.moltbot/* or */AppData/Roaming/Moltbot/* or
+    */.config/openclaw/*
 ) and not (
   file.extension : (lck or lock) or
   (

rules/cross-platform/execution_openclaw_agent_child_process.toml

@@ -0,0 +1,116 @@
+[metadata]
+creation_date = "2026/02/02"
+integration = ["endpoint"]
+maturity = "production"
+updated_date = "2026/02/02"
+
+[rule]
+author = ["Elastic"]
+description = """
+Detects suspicious child process execution from the OpenClaw, Moltbot, or Clawdbot AI coding agents running via Node.js.
+These tools can execute arbitrary shell commands through skills or prompt injection attacks. Malicious skills from
+public registries like ClawHub have been observed executing obfuscated download-and-execute commands targeting
+cryptocurrency wallets and credentials. This rule identifies shells, scripting interpreters, and common LOLBins spawned
+by these AI agents.
+"""
+from = "now-9m"
+index = ["logs-endpoint.events.process-*"]
+language = "eql"
+license = "Elastic License v2"
+name = "Execution via OpenClaw Agent"
+note = """## Triage and analysis
+
+### Investigating Execution via OpenClaw Agent
+
+OpenClaw (formerly Clawdbot, rebranded to Moltbot) is a personal AI coding assistant that can execute shell commands 
+and scripts on behalf of users. Malicious actors have weaponized the skill ecosystem (ClawHub) to distribute skills 
+that execute download-and-execute commands, targeting cryptocurrency wallets and credentials.
+
+### Possible investigation steps
+
+- Verify if OpenClaw/Moltbot is an approved application in your organization.
+- Review the child process command line for indicators of malicious activity (encoded payloads, remote downloads, credential access).
+- Check the parent Node.js process command line to identify which OpenClaw component initiated the execution.
+- Examine recently installed skills from ClawHub for malicious or obfuscated code.
+- Correlate with network events to identify data exfiltration or C2 communication.
+- Review the user's AI conversation history for prompt injection attempts.
+
+### False positive analysis
+
+- Developers legitimately using OpenClaw/Moltbot for AI-assisted coding may trigger this rule when the AI executes build scripts, curl commands, or other legitimate automation.
+- If the tool is approved, consider tuning based on specific command patterns or adding exception lists.
+
+### Response and remediation
+
+- If the child process activity appears malicious, terminate the OpenClaw gateway and investigate the skill that initiated the command.
+- Review and remove any suspicious skills from the OpenClaw configuration.
+- If credentials may have been accessed, rotate affected secrets and API keys.
+- Block known typosquat domains (moltbot.you, clawbot.ai, clawdbot.you) at the network level.
+"""
+references = [
+    "https://www.malwarebytes.com/blog/threat-intel/2026/01/clawdbots-rename-to-moltbot-sparks-impersonation-campaign",
+    "https://www.tomshardware.com/tech-industry/cyber-security/malicious-moltbot-skill-targets-crypto-users-on-clawhub",
+    "https://blogs.cisco.com/ai/personal-ai-agents-like-openclaw-are-a-security-nightmare",
+    "https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html",
+]
+risk_score = 47
+rule_id = "a7c3e8f2-4b19-4d6a-9e5c-8f1a2b3c4d5e"
+severity = "medium"
+tags = [
+    "Domain: Endpoint",
+    "Domain: LLM",
+    "OS: Linux",
+    "OS: macOS",
+    "OS: Windows",
+    "Use Case: Threat Detection",
+    "Tactic: Execution",
+    "Tactic: Command and Control",
+    "Data Source: Elastic Defend",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "eql"
+
+query = '''
+process where event.type == "start" and
+  process.parent.name : ("node", "node.exe") and 
+  process.parent.command_line : ("*openclaw*", "*moltbot*", "*clawdbot*") and
+   process.name : ("bash", "sh", "zsh", "bash.exe", "cmd.exe", "powershell.exe", "curl.exe", "curl", "base64", "xattr", "osascript", "python*", "chmod", "certutil.exe", "rundll32.exe")
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[rule.threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[rule.threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[rule.threat.technique.subtechnique]]
+id = "T1071.001"
+name = "Web Protocols"
+reference = "https://attack.mitre.org/techniques/T1071/001/"
+
+
+
+[rule.threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+

rules_building_block/execution_mcp_server_child_process.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/12/04"
 integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
 maturity = "production"
-updated_date = "2025/12/04"
+updated_date = "2026/02/03"
 
 [rule]
 author = ["Elastic"]
@@ -71,8 +71,14 @@ process where event.type == "start"
       "grok.exe", "grok",
       "qwen.exe", "qwen",
       "koboldcpp.exe", "koboldcpp", "KoboldCpp",
-      "llama-server", "llama-cli"
+      "llama-server", "llama-cli",
+      "OpenClaw", "openclaw", "openclaw.exe",
+      "Moltbot", "moltbot", "moltbot.exe",
+      "Clawdbot", "clawdbot", "clawdbot.exe"
     ) or
+    // OpenClaw/Moltbot/Clawdbot via Node.js
+    (process.parent.name in ("node", "node.exe") and
+     process.parent.command_line like~ ("*openclaw*", "*moltbot*", "*clawdbot*")) or
     // Package managers running MCP servers
     (process.parent.name in ("npx", "npx.exe", "pnpm", "pnpm.exe", "yarn", "yarn.exe", "bunx", "bunx.exe") and
      process.parent.command_line like~ ("*@modelcontextprotocol/*", "*mcp-server-*", "*mcp_server*")) or