# aeternum-botnet-runs-entire-c2-stack-on-the-polygon-blockchain — KQL variant (derived from aeternum-botnet-runs-entire-c2-stack-on-the-polygon-blockchain.sigma via sigma convert)
# source-sha256: 470584add4ba293f97bee7bd05690b843924436b9b5801c27a7cc7470f4e4c02 v1
(DestinationHostname endswith "polygon-rpc.com" or DestinationHostname endswith "rpc-mainnet.matic.network" or DestinationHostname endswith "rpc-mainnet.maticvigil.com" or DestinationHostname endswith "polygon.llamarpc.com") or (DestinationPort in~ ("8545", "8546"))