The Gentlemen - Chisel SOCKS Proxy Tunnel
Detects Chisel tunnel creation used by The Gentlemen for encrypted C2 communication. They create reverse SOCKS proxies on port 443 with very low AV detection rate, maintaining persistent internal network access.
YARA-L
