- id: 019cdeebe88f7559808213d41de3fbef
  type: correlation
  name: Unauthorized AI Agent Activity - OpenClaw/Moltbot/Clawdbot
  description: Detects execution of OpenClaw, Moltbot, or Clawdbot AI agents on enterprise devices via process execution (ProcessRollup2) and network listening activity (port 18789). These AI agents pose data exfiltration and command execution risks when deployed on corporate systems without security review.
  customerid: a4b9f94965a34f54820c8334c7d34698
  tactic: ""
  technique: ""
  mitreattack: []
  severity: 10
  search:
    outcome: detection
    filter: |
        (#event_simpleName=ProcessRollup2 (FileName=*openclaw* OR FileName=*moltbot* OR FileName=*clawdbot* OR CommandLine=*openclaw* OR CommandLine=*moltbot* OR CommandLine=*clawdbot*)) OR (#event_simpleName=NetworkConnectIP4 LocalPort=18789 LocalAddressIP4=0.0.0.0)
        | ContextBaseFileName!=aws
        | ContextBaseFileName!=aws-backint-agent
        | ParentBaseFileName!=OUTLOOK.EXE
        | FileName!=msedge.exe
        | FileName!=chrome.exe
        | table([event_simpleName, ComputerName, FileName, CommandLine, LocalPort, LocalAddress, ContextProcessId_decimal, TargetProcessId_decimal, Timestamp])
    lookback: 2h0m
    triggermode: verbose
    executionmode: scheduled
    useingesttime: false
    casetemplateid: null
  operation:
    schedule:
        definition: '@every 1h0m'
    starton: 2026-02-09T19:00:00Z
    stopon: null
    expirationon: null
    suppression: null
  apiclientid: ""
  useruuid: 0696cefa-0a88-4477-a76e-e5b693027d61
  userid: jasraj.johal@purolator.com
  updatedbyapiclientid: ""
  updatedbyuseruuid: 0696cefa-0a88-4477-a76e-e5b693027d61
  updatedbyuserid: jasraj.johal@purolator.com
  author: ""
  lastupdatedon: 2026-03-11T22:02:10.298346Z
  createdon: 2026-03-11T22:02:08.399889Z
  status: active
  statusmsg: ""
  templateid: ""
  ruleid: 0e34af131c9d4ba3af3fdf60b3a3b81b
  executorruleid: 0e34af131c9d4ba3af3fdf60b3a3b81b
  state: published
  version: 2
  notifications:
    - type: email
      config:
        recipients:
            - jasraj.johal@purolator.com
        pluginid: ""
        configid: ""
        cid: a4b9f94965a34f54820c8334c7d34698
        severity: ""
      options:
        attach_report: "false"
        send_on_failure: always
        send_on_success: never
  guardrailnotifications: []
  comment: Moved to informational
