Detecting OpenClaw using advanced posture checks

This document is a SQL detection query that aggregates counts of artifacts matching 'openclaw' across multiple inventory and telemetry tables (launchd, files, processes, homebrew/npm packages, listening ports, apps, Docker images/containers). It computes a summed score from these signals and returns an openclaw_detected flag if the score exceeds a threshold, effectively acting as a heuristic IOC/detection rule for OpenClaw presence.