Linux chisel reverse SOCKS5 staging with hidden /var/tmp dir and cron persistence

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•2

Detects malicious behaviors involving the Chisel tunneling tool, including reverse SOCKS proxy connections with TLS verification skipped, cron-based persistence referencing watchdog scripts in hidden /var/tmp directories, and associated tool staging activities.