[[ fm.text ]] Click here

Single process accessing multiple critical AI agent files

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects one process accessing multiple critical AI agent files from suspicious context.

title: Single process accessing multiple critical AI agent files
id: a7b8c9d0-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: |
  Detects one process accessing multiple critical AI agent files from suspicious context. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte un même processus qui accède à plusieurs fichiers critiques d’un agent IA depuis un contexte suspect. Ce schéma peut indiquer une collecte par un voleur d’informations, mais une maintenance légitime peut accéder à plusieurs fichiers. Le SOC L1 doit vérifier le processus, l’utilisateur, les chemins, la chronologie et les activités d’archivage ou de sortie.
related:
  - id: f1c4f294-0c3b-11f1-91a0-43ffe196cff2
    type: similar
  - id: f59de936-0c3e-11f1-97ae-9704b79e784d
    type: similar
  - id: 02b62c0a-0c3f-11f1-aa25-c7684f6249e0
    type: similar

references:
  - https://www.infostealers.com/article/hudson-rock-identifies-real-world-infostealer-infection-targeting-openclaw-configurations/

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-02-17
modified: 2026-06-21

tags:
  - attack.collection
  - attack.credential-access
  - attack.t1005
  - attack.t1552
  - attack.t1552.001

logsource:
  category: file_event
  product: windows

detection:
  selection_openclaw_dir:
    TargetFilename|contains:
      - '\.openclaw\'
      - '\.openc1aw\'

  selection_critical_files:
    TargetFilename|endswith:
      - 'openclaw.json'
      - 'device.json'
      - 'SOUL.md'
      - 'MEMORY.md'
      - 'AGENTS.md'

  # SECOND CHALLENGE 2026-06-21: added pythonw.exe (headless Python infostealer droppers)
  # and node.exe (Node.js-based stealers, common in supply-chain attacks targeting dev environments).
  selection_suspicious_accessor:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
      - '\curl.exe'
      - '\wget.exe'

  filter_legitimate:
    Image|endswith:
      - '\OpenClaw.exe'
      - '\code.exe'
      - '\notepad.exe'
      - '\explorer.exe'

  condition: (selection_openclaw_dir or selection_critical_files) and selection_suspicious_accessor and not filter_legitimate

fields:
  - TargetFilename
  - Image
  - ProcessId
  - User
  - Computer

falsepositives:
  - Extremely rare; developer scripts legitimately copying config files (allowlist by Image path)
  - Backup tools reading AI agent directories (allowlist by Image path in filter_legitimate)

level: critical

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c4177698-7c99-44ee-91e2-984e592f75a6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion