Blockchain eth_call command resolution by non-browser process
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware like SessionGate, Remus, or AnimateClipper attempting dynamic command or address resolution related to blockchain interactions.
CQL
