VSCode Infostealer Blockchain Dead-Drop C2 Resolution from Developer Processes
This rule monitors for network connections from common developer-related processes (e.g., node, python, npm) to known blockchain RPC endpoints, followed by a subsequent network connection within 5 minutes that is not directed at those RPC endpoints or common developer infrastructure (e.g., GitHub, NPM, PyPI). This pattern is often indicative of potential malicious activity, such as a compromised development environment performing beaconing or staging data after interacting with blockchain services.
Microsoft Sentinel (KQL)
