Windows Process Creation: Chisel Tunneling Tool (chisel.exe) Execution

Flags Windows executions of chisel.exe with client/server tunneling and SOCKS5 reverse arguments.

FreeUnreviewedSigmahighv1

windows-process-creation-chisel-tunneling-tool-chisel-exe-execution-8b0e12da

title: "Windows Process Creation: Chisel Tunneling Tool (chisel.exe) Execution"
id: ed0d09c3-a284-405f-8696-5bc67297924d
related:
  - id: cf93e05e-d798-4d9e-b522-b0248dc61eaf
    type: similar
  - id: 8b0e12da-d3c3-49db-bb4f-256703f380e5
    type: derived
status: test
description: This rule identifies execution of the Chisel tunneling utility on Windows by matching process creation events where the image ends with \chisel.exe. It further looks for command-line arguments consistent with tunneling/client-server operation, including SOCKS5 and reverse tunneling parameters and common address forms. Attackers may use tunneling tools like Chisel to proxy traffic and bypass direct network access controls, so correlating these process and command-line patterns can reveal suspicious command-and-control behavior. Telemetry relies on Windows process creation logs with the image path and full command line.
references:
  - https://github.com/jpillora/chisel/
  - https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/
  - https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_chisel.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-13
modified: 2023-02-13
tags:
  - attack.command-and-control
  - attack.t1090.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \chisel.exe
  selection_param1:
    CommandLine|contains:
      - "exe client "
      - "exe server "
  selection_param2:
    CommandLine|contains:
      - -socks5
      - -reverse
      - " r:"
      - ":127.0.0.1:"
      - "-tls-skip-verify "
      - :socks
  condition: selection_img or all of selection_param*
falsepositives:
  - Some false positives may occur with other tools with similar commandlines
level: high
license: DRL-1.1

What it detects

This rule identifies execution of the Chisel tunneling utility on Windows by matching process creation events where the image ends with \chisel.exe. It further looks for command-line arguments consistent with tunneling/client-server operation, including SOCKS5 and reverse tunneling parameters and common address forms. Attackers may use tunneling tools like Chisel to proxy traffic and bypass direct network access controls, so correlating these process and command-line patterns can reveal suspicious command-and-control behavior. Telemetry relies on Windows process creation logs with the image path and full command line.

Known false positives

Some false positives may occur with other tools with similar commandlines

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.