Best Detection of 2026 Series – EtherHiding Blockchain-Resolved Command-and-Cont

Ibrahim Saud@tektrix

•updated 9 days ago•0•0•0

Detects browser processes performing JSON-RPC network connections to known public blockchain node providers, a network behavior characteristic of the EtherHiding technique used by the ErrTraffic MaaS platform to resolve C2 infrastructure via smart contracts. This rule identifies the network-side beaconing and should be correlated with suspicious process execution chains (e.g., browser-spawned PowerShell/cmd).