SloppyRAT EtherHiding Polygon JSON-RPC C2 Resolution

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•0

Detects network activity associated with the EtherHiding technique, where adversaries leverage the Polygon blockchain to resolve command-and-control (C2) infrastructure and communicate with malicious smart contracts. This rule identifies specific JSON-RPC requests ('eth_call') using SloppyRAT contract selectors and DNS queries for blockchain-related RPC endpoints.