Elastic high stable eql

Potential Etherhiding C2 via Blockchain Connection

Detects when a scripting interpreter makes an outbound network connection to an Ethereum blockchain endpoint for command and control purposes. Adversaries may leverage Ethereum blockchain infrastructure as a covert C2 channel to receive commands and exfiltrate data, as observed in campaigns like SleepyDuck malware.

View Source

Detection Logic

sequence by process.entity_id with maxspan=15s
  [network where host.os.type == "macos" and event.type == "start" and
    (process.name in ("bash", "sh", "zsh", "osascript", "node", "Cursor", "Cursor Helper (Plugin)", "Windsurf", "Windsurf Helper (Plugin)") or
    process.name like ("python*", "ruby*", "perl*", "tclsh*")) and
    destination.domain like ("eth-mainnet*", "ethereum*", "eth.*.com",
                              "*.drpc.org", "polygon-rpc.com", "polygon-mainnet*", "*.polygon.technology",
                              "bsc-dataseed*", "*.bnbchain.org", "arb1.arbitrum.io", "mainnet.base.org",
                              "rpc.ankr.com", "*.infura.io", "*.alchemy.com", "*.quiknode.pro",
                              "*.publicnode.com", "*.chainstack.com")]
  [file where host.os.type == "macos" and event.action == "modification" and file.extension in ("js", "py", "sh")]

Field Validations

Loading…

Comments (0)

Loading comments...