Adversaries send messages containing malicious attachments or links. In ClawHavoc, emails delivered links to malicious ClawHub skills or embedded curl commands in skill installation documentation.

Hunt for: Emails containing ClawHub skill installation links
Alert on: curl | bash patterns in shell history
Monitor: Unexpected OpenClaw skill installs from external sources

Adversaries manipulate products or delivery mechanisms before the target receives them. ClawHavoc used ClawHub's marketplace as the distribution vehicle, inserting 1,184 malicious packages into a trusted channel.

Audit: ClawHub skill install log against approved package list
Monitor: New skill installs outside of change control window
Alert: Skills installed by non-admin users

Adversaries abuse command-line interfaces to execute malicious commands. ClawHavoc delivered payloads via curl commands piped into bash, bypassing file-based AV detection by running payloads directly in memory.

Alert: curl * | bash or curl * | sh patterns
Hunt: Bash invocations spawned by OpenClaw processes
Monitor: /tmp directory for executable files created at runtime

Adversaries execute payloads directly into memory without writing to disk, evading file-based detection. ClawHavoc payloads were loaded into process memory via the scripting interpreter chain.

Monitor: Memory-only execution in OpenClaw agent processes
Alert: Processes with no on-disk binary counterpart
Hunt: Unusual memory regions with execute permissions

Adversaries create or modify system-level processes to repeatedly execute malicious payloads. ClawHavoc used this for persistence by creating launch agents on macOS that survived reboots.

Monitor: ~/Library/LaunchAgents/ for new .plist files
Alert: systemd unit file creation outside of package manager
Hunt: Services referencing OpenClaw directories

Adversaries create accounts to maintain access. In some ClawHavoc variants, new system or service accounts were created to provide a persistent backdoor independent of the OpenClaw agent session.

Alert: New user account creation outside of IT provisioning workflow
Hunt: Accounts with no MFA enrollment created during attack window
Monitor: sudo access granted to non-standard accounts

Adversaries attempt to dump credentials to obtain account login and credential material. ClawHavoc targeted browser-stored passwords, AWS credentials, SSH private keys, and cryptocurrency wallet files.

Alert: File reads on ~/.aws/credentials or ~/.ssh/id_rsa
Monitor: Browser password store access by non-browser processes
Hunt: Processes reading keychain databases or wallet files

Adversaries encrypt communications to blend in with normal traffic. ClawHavoc used encrypted channels for C2 communication to 91.92.242.30, making payload content invisible to standard network inspection.

Alert: Outbound TLS connections to 91.92.242.30
Monitor: Port 8000 activity from OpenClaw agent processes
Hunt: Encrypted uploads with high byte-to-request ratio

Adversaries use proxies to route traffic through intermediary systems. ClawHavoc used compromised OpenClaw agents as SSH proxies, routing C2 traffic through trusted internal hosts to blend with normal traffic.

Monitor: SSH tunneling or port-forwarding from agent hosts
Alert: Unexpected outbound connections proxied through internal systems
Hunt: -D or -L flags in SSH process arguments

Adversaries transfer tools or other files from an external system into a compromised environment. ClawHavoc used this to pull additional malware stages from C2 after initial access, enabling multi-stage payload delivery.

Alert: curl/wget downloads from non-approved domains by agent process
Monitor: New executables created in /tmp or agent working directories
Hunt: File transfers from 91.92.242.30 or associated infrastructure