GOLD ENCOUNTER Chisel TCP/HTTP Tunnel Execution and C2 Connectivity
Detects the execution of the Chisel proxy/tunneling tool and associated network activity. The rule monitors for processes named 'chisel' with command-line arguments indicative of server or client mode, as well as network connections initiated by such processes, specifically flagging non-standard ports or known tunneling indicators on standard ports.
Splunk (SPL)
