{"id":"8b0e12da-d3c3-49db-bb4f-256703f380e5","title":"PUA - Chisel Tunneling Tool Execution","description":"Detects usage of the Chisel tunneling tool via the commandline arguments","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-13","modified":"2023-02-13","tags":["attack.command-and-control","attack.t1090.001"],"technique_ids":["T1090.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Some false positives may occur with other tools with similar commandlines"],"references":["https://github.com/jpillora/chisel/","https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/","https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_chisel.yml","source_sha256":"ed3ead46ee0731b89a9fe6d95d2a5d4ba9e8050d460fb3bb1e09b97b69cb2f6d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_chisel.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - Chisel Tunneling Tool Execution\nid: 8b0e12da-d3c3-49db-bb4f-256703f380e5\nrelated:\n    - id: cf93e05e-d798-4d9e-b522-b0248dc61eaf\n      type: similar\nstatus: test\ndescription: Detects usage of the Chisel tunneling tool via the commandline arguments\nreferences:\n    - https://github.com/jpillora/chisel/\n    - https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/\n    - https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-09-13\nmodified: 2023-02-13\ntags:\n    - attack.command-and-control\n    - attack.t1090.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        Image|endswith: '\\chisel.exe'\n    selection_param1:\n        CommandLine|contains:\n            - 'exe client '\n            - 'exe server '\n    selection_param2:\n        CommandLine|contains:\n            - '-socks5'\n            - '-reverse'\n            - ' r:'\n            - ':127.0.0.1:'\n            - '-tls-skip-verify '\n            - ':socks'\n    condition: selection_img or all of selection_param*\nfalsepositives:\n    - Some false positives may occur with other tools with similar commandlines\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1090.001","id":"T1090.001","name":"Internal Proxy","page":"techniques/enterprise/T1090.001/"}],"data_path":"data/detection-rules/8b0e12da-d3c3-49db-bb4f-256703f380e5.json","kind":"sigma"}