Detect Potential Etherhiding Activity
Detects network connections to blockchain APIs that are indicative of EtherHiding techniques, specifically those used by UNC5342 to retrieve malicious payloads. It identifies connections to domains containing keywords like 'explorer', 'block', 'cypher', 'eth', 'bit', 'coin', or 'crypto', combined with suspicious URL patterns such as 'eth_call' (a read-only function call for smart contracts) or 'apiKey=freekey' (a common free API key used by threat actors).
Microsoft Sentinel (KQL)
