Windows Process Creation: Chisel Tunneling Tool (chisel.exe) Execution
Flags Windows executions of chisel.exe with client/server tunneling and SOCKS5 reverse arguments.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-13
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies execution of the Chisel tunneling utility on Windows by matching process creation events where the image ends with \chisel.exe. It further looks for command-line arguments consistent with tunneling/client-server operation, including SOCKS5 and reverse tunneling parameters and common address forms. Attackers may use tunneling tools like Chisel to proxy traffic and bypass direct network access controls, so correlating these process and command-line patterns can reveal suspicious command-and-control behavior. Telemetry relies on Windows process creation logs with the image path and full command line.
Reporting behind it
- github.comhttps://github.com/jpillora/chisel/
- arcticwolf.comhttps://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/
- blog.sekoia.iohttps://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_chisel.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Chisel Tunneling Tool (chisel.exe) Execution"
id: ed0d09c3-a284-405f-8696-5bc67297924d
related:
- id: cf93e05e-d798-4d9e-b522-b0248dc61eaf
type: similar
- id: 8b0e12da-d3c3-49db-bb4f-256703f380e5
type: derived
status: test
description: This rule identifies execution of the Chisel tunneling utility on Windows by matching process creation events where the image ends with \chisel.exe. It further looks for command-line arguments consistent with tunneling/client-server operation, including SOCKS5 and reverse tunneling parameters and common address forms. Attackers may use tunneling tools like Chisel to proxy traffic and bypass direct network access controls, so correlating these process and command-line patterns can reveal suspicious command-and-control behavior. Telemetry relies on Windows process creation logs with the image path and full command line.
references:
- https://github.com/jpillora/chisel/
- https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/
- https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_chisel.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-13
modified: 2023-02-13
tags:
- attack.command-and-control
- attack.t1090.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \chisel.exe
selection_param1:
CommandLine|contains:
- "exe client "
- "exe server "
selection_param2:
CommandLine|contains:
- -socks5
- -reverse
- " r:"
- ":127.0.0.1:"
- "-tls-skip-verify "
- :socks
condition: selection_img or all of selection_param*
falsepositives:
- Some false positives may occur with other tools with similar commandlines
level: high
license: DRL-1.1