Blockchain eth_call command resolution by non-browser process

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•4

This rule detects network connections where a non-browser process (specifically excluding Chrome, Edge, and Firefox) attempts to resolve dynamic commands or addresses using the JSON-RPC 'eth_call' method. It specifically targets scenarios where this activity is associated with known malware structures like SessionGate, Remus, or AnimateClipper, rather than a standalone executable name. The detection logic looks for 'eth_call' in either the DomainName or the ContextProcessCommandLine fields during network connection events.