alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Ethereum Contract Request, getAll()"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"application/json"; http.content_len; byte_test:0,<=,500,0,string,dec; http.request_body; content:"|22|eth_call|22|"; content:"|22|0x53ed5143|22|"; fast_pattern; reference:url,research.jfrog.com/post/shai-hulud-is-back-august/; reference:url,levelblue.com/blogs/spiderlabs-blog/err-hiding-and-seek-how-errtraffic-v3-leverages-etherhiding-in-clickfix-campaign; reference:url,4byte.directory; classtype:misc-activity; sid:2071402; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_08_05, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2026_08_05;)