Chisel Client Reverse SOCKS Tunnel with Authentication
Detects the execution of the Chisel client establishing a reverse SOCKS tunnel with authentication. This activity is often associated with adversaries using Chisel for command and control or data exfiltration.
Microsoft Sentinel (KQL)
