ChainWorm Accepts a Forwarding Request and Opens a New Hop

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

Detects a custom proxy process listening for forwarding instructions and creating a second outbound connection to a supplied host and service. This rule specifically looks for network events where the process image name contains 'chainworm', 'svc', or 'proxy' (case-insensitive) and the command line arguments indicate forwarding or connection establishment activities like 'forward', 'next hop', 'bind', 'listen', 'reconnect', or 'TcpClient'.