Potential EtherHiding C2 via Curl JSON-RPC Request

  1[metadata]
  2creation_date = "2026/09/08"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/08"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when curl or nscurl is spawned by a shell or osascript to make a JSON-RPC request to a blockchain
 11endpoint for command and control purposes. Adversaries may leverage blockchain smart contracts as a covert
 12C2 channel to retrieve commands or payload staging information, as observed in ClickFix campaigns.
 13"""
 14from = "now-9m"
 15index = ["logs-endpoint.events.process-*"]
 16language = "eql"
 17license = "Elastic License v2"
 18name = "Potential EtherHiding C2 via Curl JSON-RPC Request"
 19references = [
 20    "https://notes.netbytesec.com/2026/08/anatomy-of-macos-clickfix-crimekit-that.html",
 21    "https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding",
 22    "https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware",
 23
 24]
 25risk_score = 73
 26rule_id = "54285d96-2b7c-4345-890e-3c40e173f099"
 27severity = "high"
 28tags = [
 29    "Domain: Endpoint",
 30    "OS: macOS",
 31    "Use Case: Threat Detection",
 32    "Tactic: Command and Control",
 33    "Tactic: Execution",
 34    "Data Source: Elastic Defend",
 35    "Resources: Investigation Guide",
 36]
 37timestamp_override = "event.ingested"
 38type = "eql"
 39
 40query = '''
 41process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
 42  process.name in ("curl", "nscurl") and
 43  process.parent.name in ("osascript", "bash", "sh", "zsh") and
 44  process.command_line like~ ("*eth_call*", "*\"jsonrpc\"*")
 45'''
 46
 47note = """## Triage and analysis
 48
 49### Investigating Potential EtherHiding C2 via Curl JSON-RPC Request
 50
 51EtherHiding is a command and control technique in which threat actors store malicious configuration, commands,
 52or payload URLs inside smart contract data on public blockchains. Because the blockchain is immutable and the
 53RPC endpoints are legitimate public infrastructure, this provides a takedown-resistant C2 channel. On macOS,
 54ClickFix-delivered loaders have been observed reading contract data by spawning curl from a shell or osascript
 55with a raw JSON-RPC eth_call request body.
 56
 57### Possible investigation steps
 58
 59- Review process.command_line to identify the destination RPC endpoint, the contract address in the eth_call
 60  parameters, and the method selector.
 61- Examine the parent process chain (process.parent.command_line, effective parent) to determine how the shell
 62  or osascript was launched — interactive terminal, LaunchAgent, or another persistence mechanism.
 63- Search the same host for follow-on network connections shortly after this event; EtherHiding reads are
 64  typically followed by a connection to the decoded C2 host.
 65- Check for recent LaunchAgent or LaunchDaemon plist creation on the host, which commonly accompanies this
 66  activity as persistence.
 67- Search the contract address against threat intelligence sources to identify the associated campaign.
 68- Pivot fleet-wide on the destination RPC domain and any decoded C2 domains to identify additional hosts.
 69
 70### False positive analysis
 71
 72- Web3 developers may test contract calls with curl against RPC endpoints. Verify whether the user has a
 73  legitimate blockchain development role and whether the parent context (terminal session vs. persistence
 74  item) matches interactive development work.
 75- CI or build scripts that query chain state via curl could match. Confirm with the owning team and consider
 76  excluding specific parent scripts or hosts.
 77
 78### Response and remediation
 79
 80- Isolate the affected host to interrupt the C2 channel.
 81- Terminate the parent shell or osascript process tree.
 82- Identify and remove any associated persistence (LaunchAgents/LaunchDaemons) and decoded payloads.
 83- Block decoded C2 domains identified from the contract data; note that blocking public RPC aggregators may
 84  impact legitimate use and should be a risk-based decision.
 85- Rotate credentials accessible from the host and review for evidence of data theft.
 86- Escalate for full incident response if the activity chains from a ClickFix or social engineering delivery.
 87"""
 88
 89[[rule.threat]]
 90framework = "MITRE ATT&CK"
 91
 92[[rule.threat.technique]]
 93id = "T1102"
 94name = "Web Service"
 95reference = "https://attack.mitre.org/techniques/T1102/"
 96
 97[[rule.threat.technique.subtechnique]]
 98id = "T1102.001"
 99name = "Dead Drop Resolver"
100reference = "https://attack.mitre.org/techniques/T1102/001/"
101
102[[rule.threat.technique.subtechnique]]
103id = "T1102.002"
104name = "Bidirectional Communication"
105reference = "https://attack.mitre.org/techniques/T1102/002/"
106
107[rule.threat.tactic]
108id = "TA0011"
109name = "Command and Control"
110reference = "https://attack.mitre.org/tactics/TA0011/"
111
112[[rule.threat]]
113framework = "MITRE ATT&CK"
114
115[[rule.threat.technique]]
116id = "T1059"
117name = "Command and Scripting Interpreter"
118reference = "https://attack.mitre.org/techniques/T1059/"
119
120[[rule.threat.technique.subtechnique]]
121id = "T1059.002"
122name = "AppleScript"
123reference = "https://attack.mitre.org/techniques/T1059/002/"
124
125[[rule.threat.technique.subtechnique]]
126id = "T1059.004"
127name = "Unix Shell"
128reference = "https://attack.mitre.org/techniques/T1059/004/"
129
130[rule.threat.tactic]
131id = "TA0002"
132name = "Execution"
133reference = "https://attack.mitre.org/tactics/TA0002/"```