How do you detect Chisel tunnels?

Detect Chisel by its command-line grammar (chisel client with R:socks or R:port specifications, or chisel server with --reverse), by large unsigned Go binaries arriving in user-writable paths followed by outbound connections from the same process, and on the wire by the chisel-v3 WebSocket subprotocol where HTTP is visible or decrypted. Without inspection, hunt for one long-lived upgrade connection to a rare external host on 80, 443 or 8080. Because binaries are renamed and forks change strings, correlate host and network signals.

Detecting Chisel: HTTP and WebSocket Tunnels Over Allowed Ports

Chisel is an open-source tunnel written in Go that multiplexes TCP (and UDP) streams over a single HTTP connection upgraded to WebSocket, secured with SSH. It is popular with operators because the single static binary works on any platform and rides allowed web ports. A client started with R:socks turns a compromised host into a reverse SOCKS pivot.

Signals at a Glance

Signal	Where	ATT&CK
chisel client or server with R:socks, R:port or --reverse arguments	Sysmon 1, 4688, auditd, EDR	T1572
WebSocket upgrade carrying Sec-WebSocket-Protocol chisel-v3	TLS-inspecting proxy, Suricata, Zeek HTTP	T1572
Single long-lived HTTP or WebSocket connection to a rare external host	Proxy, Zeek conn.log	T1090
Large unsigned Go binary written to a user-writable path	Sysmon 11, EDR	T1105
New SOCKS listener on the client after tunnel establishment	EDR network telemetry	T1090.001

Command Lines and Binary Artifacts

Chisel is invoked with a small, distinctive grammar: a server address followed by remote specifications such as R:socks or R:8080:127.0.0.1:80. Operators often rename the binary, so match the arguments rather than the filename:

title: Chisel Client Reverse Tunnel Arguments
logsource:
  category: process_creation
detection:
  selection_client:
    CommandLine|contains: ' client '
  selection_spec:
    CommandLine|contains:
      - ' R:socks'
      - ' R:'
      - ':socks'
  selection_server:
    CommandLine|contains|all:
      - ' server '
      - '--reverse'
  condition: (selection_client and selection_spec) or selection_server
level: high
# tune/validate: ' R:' is broad; require the client keyword and a URL-like
# host:port argument, and correlate with the binary's hash or file origin.

Binaries are large (roughly 8-12 MB), statically linked and unsigned. A new executable of that size arriving through a download cradle, followed by an outbound connection from the same process, is a strong sequence to correlate.

Network Fingerprints

A Chisel server answers ordinary HTTP requests with a short fixed body and performs the WebSocket upgrade only for clients that offer its subprotocol. Where you can see plaintext or decrypted HTTP, match the subprotocol header:

# Suricata - Chisel WebSocket subprotocol (local sid range; validate before use)
alert http any any -> any any (msg:"HUNT Chisel WebSocket subprotocol"; flow:established,to_server; http.header; content:"Sec-WebSocket-Protocol|3a| chisel-v3"; nocase; classtype:trojan-activity; sid:9100001; rev:1;)

Without TLS inspection the subprotocol is invisible; fall back to duration, byte symmetry and destination rarity on connections to 80/443/8080.
Hunt for a client that connects once and stays connected for hours to a destination first seen in the last 30 days.
Check for a rare outbound destination whose only observed behaviour is one persistent upgrade connection and no page content.
Rebuilt Chisel forks change the subprotocol string, so treat the header match as one signal among several.

Vetted sources

Use the SigmaHQ and Elastic process-creation coverage for tunneling tools, ET Open and Suricata HTTP header matching, and Zeek HTTP and connection logs. Validate every pattern against your own baseline — the argument grammar and subprotocol string are version-dependent and operators can change both.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Command Lines and Binary Artifacts

Network Fingerprints

Build Detections That Fire

Protocol Tunneling Detection

Detection Hub

FRP Tunnel Detection

SOCKS Proxy Detection