alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Ethereum Contract Request, getAll()"; reference:url,research.jfrog.com/post/shai-hulud-is-back-august/; reference:url,levelblue.com/blogs/spiderlabs-blog/err-hiding-and-seek-how-errtraffic-v3-leverages-etherhiding-in-clickfix-campaign; reference:url,4byte.directory; classtype:misc-activity; sid:2071402; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_08_05, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2026_08_05;)