T1572: Miku Chisel Tunnel via Scheduled Task "Tunnel" to 69.48.228.86

Yougesh Raj@yougesh

•updated 17 days ago•1•0•6

Detects the execution of the Chisel C2 tool by matching its unique command-line grammar, specifically the 'client' subcommand combined with reverse remote ('R:') configurations. This detection strategy is resilient against binary renaming and infrastructure rotation by focusing on the tool's required argument structure rather than static IOCs like filenames or C2 addresses. It is specifically useful for identifying unauthorized remote tunnels used for persistence and data exfiltration.