Chisel Tunneling Tool Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•27

Detects the execution of the Chisel tunneling tool by analyzing command-line arguments. Chisel is a fast TCP/UDP tunnel, secured by SSH, and can be used for various tunneling purposes, including creating SOCKS5 proxies or reverse tunnels. This rule specifically looks for the 'chisel.exe' image name combined with common client/server commands and tunneling parameters like '-socks5', '-reverse', or '-tls-skip-verify'.