Detectionhightest

HackTool - SharpChisel Execution

Detects usage of the Sharp Chisel via the commandline arguments

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Mon Sep 05Updated Mon Feb 13cf93e05e-d798-4d9e-b522-b0248dc61eafwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        - Image|endswith: '\SharpChisel.exe'
        - Product: 'SharpChisel'
    # See rule 8b0e12da-d3c3-49db-bb4f-256703f380e5 for Chisel.exe coverage
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

TA0011 · Command and Control

Sub-techniques

T1090.001 · Internal Proxy

Related Rules

SimilarDetectionhigh

PUA - Chisel Tunneling Tool Execution

Detects usage of the Chisel tunneling tool via the commandline arguments

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

cf93e05e-d798-4d9e-b522-b0248dc61eaf

Status

test

Level

high

Type

Detection

Created

Mon Sep 05

Modified

Mon Feb 13

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml

Raw Tags

attack.command-and-controlattack.t1090.001

View on GitHub