Chisel Reverse Proxy TCP-over-HTTP Tunnel Session (Operation Escaneo)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

This rule monitors process execution events for the presence of the Chisel network tunneling tool. It identifies Chisel by its executable names (e.g., chisel.exe, chisel_linux) and command-line arguments typical of a Chisel client or server configuration, including SOCKS proxy setups and known indicator ports.