This rule detects potential EtherHiding C2 activity on macOS by identifying when curl or nscurl are spawned by a shell or osascript to perform a JSON-RPC request (eth_call) to a blockchain endpoint. EtherHiding is a technique where threat actors store commands or payloads in public blockchain smart contracts, using the immutable blockchain and public RPC infrastructure as a covert, takedown-resistant C2 channel. The detection looks for a process start event where the process name is curl or nscurl, the parent process is a shell or osascript (osascript, bash, sh, zsh), and the command line contains JSON-RPC elements (eth_call and a JSON-RPC payload). This maps to MITRE techniques around Command and Control via a dead drop resolver and potential bidirectional communication, with the execution context tied to command scripting interpreters (AppleScript, Unix Shell). When triggered, the rule provides triage guidance to identify the target RPC endpoint, contract address, and method selector, assess how the shell was launched, and search for subsequent network connections or persistence mechanisms that might indicate broader compromise. Guidance covers false positives from legitimate blockchain testing or CI/build scripts and recommends context-specific filtering. Remediation steps include isolating the host, terminating the involved process tree, removing related persistence items (LaunchAgents/LaunchDaemons), blocking decoded C2 domains with risk-aware consideration due to potential impact on legitimate blockchain use, rotating credentials, and escalating to full IR if part of a wider ClickFix delivery chain.