Scripting or Unsigned Binary Performing DNS Lookups to Ethereum RPC Providers

[rule]
description = """
Identifies scripting engines or unsigned/suspicious-path processes followed by DNS lookups to known Ethereum RPC
provider domains. This may indicate cryptocurrency mining, wallet drainers, or other blockchain-related malware using
public RPC infrastructure for command and control or on-chain interaction.
"""
id = "a3c8e0f7-5b9d-1e4a-c2f6-8e7b5a4d3c1f"
license = "Elastic License v2"
name = "Scripting or Unsigned Binary Performing DNS Lookups to Ethereum RPC Providers"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/tactics/TA0011/",
    "https://attack.mitre.org/techniques/T1071/004/",
    "https://attack.mitre.org/techniques/T1496/",
]
version = "1.0.1"

query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
 (
  process.name : ("node.exe", "javaw.exe", "python*.exe", "deno.exe", "powershell.exe", "wscript.exe", "AutoIt*.exe") or
  process.pe.original_file_name : ("node.exe", "javaw.exe", "java.exe", "python*.exe", "deno.exe", "powershell.exe", "wscript.exe", "AutoIt*.exe") or
  process.code_signature.subject_name : ("OpenJS Foundation", "Python Software Foundation", "Deno", "Eclipse.org Foundation, Inc.", "AutoIt Consulting Ltd") or
  ((process.code_signature.trusted == false or process.code_signature.exists == false) and
   (process.Ext.relative_file_name_modify_time <= 500 or process.Ext.relative_file_creation_time <= 500))
 )]
[dns where dns.question.name : (
  "*ethereum.org",
  "*infura.io",
  "*alchemy.com",
  "*alchemyapi.io",
  "*ankr.com",
  "*quiknode.pro",
  "*tatum.io",
  "*thirdweb.com",
  "*tenderly.co",
  "*flashbots.net",
  "*mevblocker.io",
  "*drpc.org",
  "*blockpi.network",
  "*llamarpc.com",
  "*1rpc.io",
  "*0xrpc.io",
  "*nodies.app",
  "*blastapi.io",
  "*nownodes.io",
  "*pokt.network",
  "*merkle.io",
  "*blinklabs.xyz",
  "*leorpc.com",
  "*publicnode.com",
  "*cloudflare-eth.com",
  "*payload.de",
  "*etherscan.io",
  "*api.etherscan.io",
  "*ethplorer.io",
  "*blockchair.com",
  "*eth-mainnet.gateway.pokt.network",
  "*gateway.pokt.network",
  "*pokt.io",
  "*getblock.io",
  "*chainstack.com",
  "*moralis.io",
  "*quicknode.com",
  "*quiknode.com",
  "*figment.io",
  "*nodesmith.io",
  "*blockdaemon.com",
  "*onfinality.io",
  "*ankr-rpc.com",
  "*rpc.flashbots.net",
  "*rpc.mevblocker.io",
  "*eth.llamarpc.com",
  "*mainnet.publicnode.com",
  "*ethereum.publicnode.com",
  "*rpc.payload.de",
  "*hardhat.org",
  "*foundry.paradigm.xyz",
  "*paradigm.xyz",
  "*ethrpc.com",
  "*web3api.com"
)]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"



[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "8.10.0"