---
id: 9a8b7c6d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
title: PowerShell Command Downloads MSI File - OpenClaw Vector
description: Detects PowerShell commands that download MSI files, a technique observed in the OpenClaw campaign delivering Remcos RAT via DeepSeek-Claw skills.
status: experimental
author: Security Arsenal
date: 2026/05/11
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'wget'
            - 'curl'
            - 'DownloadFile'
    filter_extension:
        CommandLine|contains: '.msi'
    condition: selection and filter_extension
falsepositives:
    - System administration software installation
level: high
---
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
title: Potential Remcos RAT Installation - Registry Key
description: Detects the creation of registry keys often used by Remcos RAT for persistence, as seen in the OpenClaw/Remcos campaign.
status: experimental
author: Security Arsenal
date: 2026/05/11
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    category: registry_add
detection:
    selection:
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run'
            - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
        Details|contains:
            - 'Remcos'
            - 'System32\remcos'
    condition: selection
falsepositives:
    - Legitimate software using similar names (rare)
level: high
---
id: c2d3e4f5-6a7b-8c9d-0e1f-2a3b4c5d6e7f
title: Browser Encryption Bypass Attempt - Suspicious Process Access
description: Detects processes accessing browser databases (Cookies, History) with suspicious handle access patterns, indicative of stealers like Remus/Lumma attempting ABE bypass.
status: experimental
author: Security Arsenal
date: 2026/05/11
tags:
    - attack.credential_access
    - attack.t1005
logsource:
    product: windows
    category: process_access
detection:
    selection_target:
        TargetImage|contains:
            - '\Google\Chrome\User Data\Default\'
            - '\Microsoft\Edge\User Data\Default\'
            - '\BraveSoftware\Brave-Browser\User Data\Default\'
    selection_granted:
        GrantedAccess|contains:
            - '0x1010'
            - '0x1410'
            - '0x143a'
    condition: selection_target and selection_granted
falsepositives:
    - Legitimate backup or browser management tools
level: medium


kql
// Hunt for connections to known Remus and ClickFix IPs
DeviceNetworkEvents
| where RemoteIP in ("45.94.47.204", "217.156.122.57", "217.156.122.75", "217.156.122.12", "45.151.106.110")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteURL, InitiatingProcessCommandLine

// Hunt for execution of file hashes associated with OpenClaw/Remcos
DeviceProcessEvents
| where SHA1 in ("470c3803bd5a4770eb5470a84a831f187f591c64") or MD5 in ("1c267cab0a800a7b2d598bc1b112d5ce", "2a5f619c966ef79f4586a433e3d5e7ba", "2c4b7c8b48e6b4e5f3e8854f2abfedb5", "82536825e700f4c863238a90dd314687", "cc1af839a956c8e2bf8e721f5d3b7373")
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName


powershell
# IOC Hunt Script for Remcos/Remcos Related Files
# Checks for specific MD5 hashes mentioned in the OpenClaw pulse

$targetHashes = @(    "1c267cab0a800a7b2d598bc1b112d5ce",
    "2a5f619c966ef79f4586a433e3d5e7ba",
    "2c4b7c8b48e6b4e5f3e8854f2abfedb5",
    "82536825e700f4c863238a90dd314687",
    "cc1af839a956c8e2bf8e721f5d3b7373"
)

Write-Host "Scanning for malicious file hashes..." -ForegroundColor Yellow

# Get files in common download/appdata directories (limit to last 7 days for performance)
$paths = @("$env:USERPROFILE\Downloads", "$env:APPDATA", "$env:LOCALAPPDATA")

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | 
        ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($hash -in $targetHashes) {
                Write-Host "[MATCH] Malicious file found: $($_.FullName)" -ForegroundColor Red
                Write-Host "Hash: $hash" -ForegroundColor Red
            }
        }
    }
}

Write-Host "Scan complete."


# Response Priorities

*   **Immediate**:
    *   Block all listed domains and IP addresses at the perimeter firewall and proxy servers.
    *   Initiate a hunt for the specific file hashes provided in the OpenClaw pulse across all endpoints.
    *   Review DNS logs for resolutions to `dropras.xyz` and `trackpipe.dev`.

*   **24 Hours**:
    *   **Credential Audit**: Given the Remus Stealer's capability to bypass browser encryption, force a password reset for high-privilege accounts and users who may have been exposed to the ClickFix or Remos campaigns.
    *   **Session Review**: Analyze Active Directory logs for anomalous logon attempts originating from the Remus C2 IP ranges.

*   **1 Week**:
    *   **Browser Hardening**: Enforce Enterprise Browser policies to disable or restrict developer tools and extensions where possible to mitigate infostealer impact.
    *   **AI Governance**: Review and restrict the usage of AI agent frameworks (like OpenClaw) within the development environment. Implement strict sandboxing for code generated by AI agents.
    *   **macOS Security**: Deploy configuration profiles to restrict the execution of unsigned terminal commands or scripts downloaded from the internet (Gatekeeper hardening).