Potential EtherHiding C2 via Curl JSON-RPC Request

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Potential EtherHiding C2 via Curl JSON-RPC Request

Detects when curl or nscurl is spawned by a shell or osascript to make a JSON-RPC request to a blockchain endpoint for command and control purposes. Adversaries may leverage blockchain smart contracts as a covert C2 channel to retrieve commands or payload staging information, as observed in ClickFix campaigns.

Rule type: eql

Rule indices:

logs-endpoint.events.process-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
OS: macOS
Use Case: Threat Detection
Tactic: Command and Control
Tactic: Execution
Data Source: Elastic Defend
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Potential EtherHiding C2 via Curl JSON-RPC Request

EtherHiding is a command and control technique in which threat actors store malicious configuration, commands, or payload URLs inside smart contract data on public blockchains. Because the blockchain is immutable and the RPC endpoints are legitimate public infrastructure, this provides a takedown-resistant C2 channel. On macOS, ClickFix-delivered loaders have been observed reading contract data by spawning curl from a shell or osascript with a raw JSON-RPC eth_call request body.

Possible investigation steps

Review process.command_line to identify the destination RPC endpoint, the contract address in the eth_call parameters, and the method selector.
Examine the parent process chain (process.parent.command_line, effective parent) to determine how the shell or osascript was launched — interactive terminal, LaunchAgent, or another persistence mechanism.
Search the same host for follow-on network connections shortly after this event; EtherHiding reads are typically followed by a connection to the decoded C2 host.
Check for recent LaunchAgent or LaunchDaemon plist creation on the host, which commonly accompanies this activity as persistence.
Search the contract address against threat intelligence sources to identify the associated campaign.
Pivot fleet-wide on the destination RPC domain and any decoded C2 domains to identify additional hosts.

False positive analysis

Web3 developers may test contract calls with curl against RPC endpoints. Verify whether the user has a legitimate blockchain development role and whether the parent context (terminal session vs. persistence item) matches interactive development work.
CI or build scripts that query chain state via curl could match. Confirm with the owning team and consider excluding specific parent scripts or hosts.

Response and remediation

Isolate the affected host to interrupt the C2 channel.
Terminate the parent shell or osascript process tree.
Identify and remove any associated persistence (LaunchAgents/LaunchDaemons) and decoded payloads.
Block decoded C2 domains identified from the contract data; note that blocking public RPC aggregators may impact legitimate use and should be a risk-based decision.
Rotate credentials accessible from the host and review for evidence of data theft.
Escalate for full incident response if the activity chains from a ClickFix or social engineering delivery.

Rule query

edit

process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
  process.name in ("curl", "nscurl") and
  process.parent.name in ("osascript", "bash", "sh", "zsh") and
  process.command_line like~ ("*eth_call*", "*\"jsonrpc\"*")

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Command and Control
- ID: TA0011
- Reference URL: https://attack.mitre.org/tactics/TA0011/
Technique:
- Name: Web Service
- ID: T1102
- Reference URL: https://attack.mitre.org/techniques/T1102/
Sub-technique:
- Name: Dead Drop Resolver
- ID: T1102.001
- Reference URL: https://attack.mitre.org/techniques/T1102/001/
Sub-technique:
- Name: Bidirectional Communication
- ID: T1102.002
- Reference URL: https://attack.mitre.org/techniques/T1102/002/
Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Technique:
- Name: Command and Scripting Interpreter
- ID: T1059
- Reference URL: https://attack.mitre.org/techniques/T1059/
Sub-technique:
- Name: AppleScript
- ID: T1059.002
- Reference URL: https://attack.mitre.org/techniques/T1059/002/
Sub-technique:
- Name: Unix Shell
- ID: T1059.004
- Reference URL: https://attack.mitre.org/techniques/T1059/004/

« Potential Escalation via Vulnerable MSI Repair Potential Etherhiding C2 via Blockchain Connection »