Blackwood/Chisel reverse SOCKS5 tunnel handshake to Iranian C2 IP
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Suricata
