Blockchain eth_call command resolution by non-browser process
This rule detects the use of the JSON-RPC 'eth_call' method by non-browser processes during network connection events. It specifically looks for network connections where the initiating process is not a common web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the 'eth_call' method. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the Check Point research.
CQL
