ChainScript repeated Polygon eth_call C2 resolver re-query (rotation)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•1

This rule detects repeated HTTP POST requests to a Polygon blockchain endpoint ('eth_call') containing specific contract address and method identifiers. This behavior is indicative of 'EtherHiding', a technique where attackers use blockchain smart contracts to host malicious C2 configurations or update C2 infrastructure, allowing for stealthy dynamic command and control rotation.