PUA - Chisel Tunneling Tool Execution

About the rule

Rule Type

Standard

Rule Description

Detects execution of the Chisel tunneling tool and related command line arguments indicating its use for proxy tunneling, including client/server modes, SOCKS5 proxy usage, reverse tunnels, and TLS verification bypass.

Severity

Trouble

Rule journey

Attack chain scenario

Command and Control: Proxy - Internal Proxy (T1090.001)

Impact

Enables covert proxy communication channels used by attackers for command and control, lateral movement, or data exfiltration.

Rule Requirement

Prerequisites

Using Windows Event Viewer

1. Log in to a domain controller with domain admin credentials.
2. Open the Group Policy Management Console (GPMC) by typing gpmc.msc in the Run dialog.
3. Create a new Group Policy Object (GPO) or edit an existing one linked to the appropriate Organizational Unit (OU).
4. Navigate to:
   Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking
5. Right-click on Audit Process Creation and select Properties.
6. Select Configure the following audit events, check Success, and click OK.
7. Right-click on Audit Process Termination and select Properties.
8. Select Configure the following audit events, check Success, and click OK.

For enhanced process tracking (command line logging):

1. Navigate to:
   Computer Configuration > Administrative Templates > System > Audit Process Creation
2. Double-click on Include command line in process creation events.
3. Select Enabled, then click OK.
4. Create the following registry key if it does not already exist:
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Security-Auditing\Operational

Using Sysmon (System Monitor)

1. Download and install Sysmon from Microsoft Sysinternals.
2. Open Command Prompt with administrator privileges.
3. Create or download a Sysmon configuration file that includes process creation monitoring.
4. Install Sysmon using the configuration file:
   Example command: sysmon.exe -i configfile.xml
5. Ensure the configuration file contains an event filter to capture process creation events.
   Example snippet:

<Sysmon>
<EventFiltering>
<ProcessCreate onmatch="exclude"/>
<!-- This captures all process creations -->
</EventFiltering>
</Sysmon>

1. Create the following registry key if it does not already exist:
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Sysmon\Operational

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

T1090.001: Internal Proxy

Security Standards

• Deploy network intrusion detection and prevention systems with signatures to detect tunneling and proxy tools.
• Monitor network traffic for proxies and tunneling connections.
• Utilize endpoint detection tooling to monitor suspicious tunneling tool execution.

Author

Florian Roth (Nextron Systems)

Future actions

Known False Positives

May generate false positives with other tools that use similar command line arguments.

Next Steps

• Investigate flagged chisel.exe executions and command line usage for unauthorized activity.
• Implement continuous monitoring of proxy and tunneling activities.
• Educate security teams on detection and response to proxy tunneling.

Mitigation