SleepyDuck Malware Etherhiding
This rule detects network connections to specific RPC addresses and a contract address associated with the SleepyDuck malware's Etherhiding technique. It filters for DNS queries containing known RPC domains and HTTP/network activity containing a specific Ethereum contract address. This indicates potential communication with the malware's command and control infrastructure for persistence.
Cortex XDR
