# aeternum-botnet-runs-entire-c2-stack-on-the-polygon-blockchain — Splunk SPL variant (derived from aeternum-botnet-runs-entire-c2-stack-on-the-polygon-blockchain.sigma via sigma convert)
# source-sha256: 470584add4ba293f97bee7bd05690b843924436b9b5801c27a7cc7470f4e4c02 v1
DestinationHostname IN ("*polygon-rpc.com", "*rpc-mainnet.matic.network", "*rpc-mainnet.maticvigil.com", "*polygon.llamarpc.com") OR DestinationPort IN (8545, 8546)