Detecting OpenClaw using advanced posture checks
ID: 06dedd74-1bbe-590b-a9c8-f495880792e9
STIX ID: report--06dedd74-1bbe-590b-a9c8-f495880792e9
Feed Name: Threat Intelligence | Blog | Okta
Threat Score
This document is a multi-source detection query for 'OpenClaw' that aggregates counts from launchd entries, filesystem paths, running processes, package managers (Homebrew, npm), listening ports (including 9090, 18789, 18791), installed apps, and Docker images/containers, then produces a binary openclaw_detected flag if the summed score exceeds a threshold.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.