huntrule

Malicious Chisel Tunneling Tool Masquerading as Microsoft Binary (via process_creation)

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-06-22
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the Chisel tunneling utility renamed to Microsoft-themed filenames such as MsChSoft.exe or MicrosoftExchange32.exe while running with client, server, or reverse forwarding arguments, a tunneling technique used by the Seashell Blizzard subgroup during the BadPilot access operation. Adversaries deploy renamed Chisel to establish persistent encrypted tunnels into compromised networks, and the mismatch between a Microsoft-styled name and tunneling arguments is a strong compromise indicator.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange
Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs
Suspicious SSH Reverse Tunnel Over DNS Port
Suspicious Reverse SSH Tunnel Exposing Local SSH via process_creation
Suspicious OpenSSH Reverse Tunnel Creation via Process Creation
Suspicious OpenSSH Reverse Tunnel Establishment via process_creation
Suspicious LocalToNet Tunneling Tool Execution
Malicious RDP Tunneling via ngrok (via process_creation)
Suspicious UUID Named Pipe Created Consistent with Mythic SMB Agent
Malicious Chisel Reverse Tunnel Execution for Protocol Tunneling
Malicious Chisel Tunneling Tool Masquerading as Microsoft Binary (via process_creation)
Pivot detection · T1572 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.