Browser Process Querying Blockchain RPC Endpoints (EtherHiding)
Detects browser processes making DNS queries or network connections to BNB Smart Chain RPC endpoints (and related EVM-compatible chain RPCs). This technique is a signal for EtherHiding-style attacks where malicious JavaScript injected into compromised websites queries smart contracts for payload retrieval. This generalizes beyond ClearFake to catch UNC5342 (North Korean DPRK) and other EtherHiding adopters documented since October 2025.
Microsoft Sentinel (KQL)
