Once inside, intruders need a reliable path from their own machine into your internal network, and open-source reverse tunnelling tools such as Ligolo-ng, Chisel and frp give them one through a single outbound connection that most firewalls allow. All three are small Go binaries built for penetration testers and network administrators, which is why they appear in red team reports and in government advisories on ransomware and state-sponsored intrusions alike. This guide explains how each tool works, the host, configuration and network artefacts it leaves, detection rules you can deploy, and the egress controls that limit them. It is aimed at detection engineers, SOC analysts and network security teams; it describes defensive signals only, not how to operate the tools.
This is an independent guide from NHI Mgmt Group, based on the public repositories of Chisel, frp and Ligolo-ng, MITRE ATT&CK and government advisories as of November 2026. It is not sponsored or reviewed by any of these projects, and it covers detection only.
Key takeaways
- Reverse tunnels invert your perimeter. The compromised host connects out to the attacker's server, then the attacker routes traffic back in, so inbound firewall rules never see a connection to block (ATT&CK T1572 Protocol Tunneling and T1090 Proxy).
- Each tool has a distinctive fingerprint. Chisel negotiates the WebSocket subprotocol chisel-v3; frp's frpc reads a frpc.toml (or legacy frpc.ini) naming a serverAddr; the Ligolo-ng agent is launched with -connect and, in WebSocket mode, sends a fixed Chrome 103 user agent unless changed.
- Real intrusions use them. CISA's Volt Typhoon advisory documents FRP clients renamed SMSvcService.exe and BrightmetricAgent.exe; ATT&CK records Scattered Spider running Chisel on vCenter; the Medusa advisory lists Ligolo as a reverse tunnelling tool.
- Detect the behaviour, not the file name. Renamed and packed binaries are normal, so long-lived outbound sessions from servers, unusual parent processes and new listening or TUN interfaces are better anchors.
- Egress control is the strongest mitigation. Servers that can reach only named destinations through an inspecting proxy leave a tunnel very few places to terminate.
How the three tools work
All three solve the same problem, reaching a network behind NAT or a firewall, in different ways. Knowing the mechanism tells you where the evidence will be.
| Tool | Mechanism | Transport | Privileges on the victim | ATT&CK |
|---|---|---|---|---|
| Ligolo-ng | Agent on the victim connects to a proxy on the operator's machine; the proxy exposes a TUN interface so the operator routes whole subnets through the agent, no SOCKS client needed | TLS over TCP (proxy listens on 0.0.0.0:11601 by default) or WebSocket over HTTP(S) | None: the project states the agent needs no administrative access | Not a separate software entry; T1572, T1090 |
| Chisel | Single binary acting as client or server; TCP and UDP tunnels and SOCKS5, forward or reverse (R: remotes) | SSH inside WebSocket over HTTP or HTTPS; server port falls back to 8080 | None for outbound use | Named in G1015 and C0064 procedures; T1572, T1090.001 |
| frp (Fast Reverse Proxy) | frpc on the victim registers with frps on a public server, which publishes internal services on its own ports | TCP, KCP, QUIC, WebSocket; TLS on by default since v0.50.0 | None for outbound use; often installed as a service for persistence | S1144; T1572, T1090, T1095 |
The common thread is a long-lived outbound session from a host that has no business holding one, followed by internal connections that appear to originate from that host. See the T1572 Protocol Tunnelling Defensive Guide for the technique view across all tunnelling methods, and the Cloudflare Tunnel and trycloudflare abuse guide for tunnels through a commercial service.
Where they have been used
- Volt Typhoon and frp: the joint advisory AA24-038A (February 2024, updated March 2024) reports Volt Typhoon implanting FRP clients on victim infrastructure, renamed SMSvcService.exe on a ShoreTel contact centre server and BrightmetricAgent.exe on another server, packed with UPX and executed through PowerShell, with a PRTG server used as an intermediary. ATT&CK also links FRP to Magic Hound, Blue Mockingbird and the 3CX supply chain campaign. See the Volt Typhoon Threat Actor Profile.
- Scattered Spider and Chisel: ATT&CK records the group installing tunnelling tools on VMware vCenter and attacker-controlled virtual machines, including Chisel configured to reach trycloudflare subdomains, alongside ngrok and Teleport. See the Scattered Spider Threat Actor Profile.
- Medusa and Ligolo: the #StopRansomware advisory AA25-071A (March 2025) lists Ligolo as a reverse tunnelling tool used to connect compromised hosts to the actor's machine, together with Cloudflared. The advisory does not say whether the original Ligolo or Ligolo-ng was used.
Host and configuration artefacts
| Tool | Process and command-line signals | Files and configuration | Persistence seen |
|---|---|---|---|
| Ligolo-ng agent | -connect host:port; -ignore-cert (marked dangerous by the project) or -accept-fingerprint; -bind for bind mode; -proxy for an upstream HTTP or SOCKS proxy; -retry and reconnect behaviour | Usually a single dropped binary; no config file on the agent side | Scheduled task or service wrapping the agent |
| Chisel | client or server verbs; -reverse, --socks5, R: remotes, socks, --tls-skip-verify, --fingerprint, --auth | Optional users.json authfile on the server; key files from --keygen | Service or cron entry; on Linux appliances, a systemd unit |
| frp client | frpc -c with a .toml, .yaml, .json or legacy .ini file | frpc.toml naming serverAddr, serverPort, auth.token and proxies with localPort and remotePort | Windows service with a misleading name (Volt Typhoon used SMSvcService.exe) |
SigmaHQ publishes process creation rules for two of the three: "PUA - Chisel Tunneling Tool Execution" matches chisel.exe, or client and server verbs combined with -socks5, -reverse, r:, :socks or -tls-skip-verify; "PUA - Fast Reverse Proxy (FRP) Execution" matches frpc.exe or frps.exe, command lines containing \frpc.ini, and known hashes. Both match on names or arguments, so extend them with the behavioural rules below. Where your EDR records PE metadata, note that these Go binaries often carry little version information, so absence of a description on a binary in a writable path is itself a hunting lead.
Network signals
- Chisel WebSocket handshake: the client requests an HTTP upgrade with Sec-WebSocket-Protocol: chisel-v3, and the inner SSH version strings are SSH-chisel-v3-client and SSH-chisel-v3-server. Over plain HTTP, or where your proxy performs TLS inspection, the subprotocol header is a high-fidelity indicator. See the TLS Inspection Guide.
- Ligolo-ng defaults: TLS to port 11601 on a new external host, and in WebSocket mode a user agent of Mozilla/5.0 on Windows with Chrome/103.0.0.0 unless the operator overrides it with -ua. A Chrome 103 user agent from a server process in 2026 stands out on any proxy log. When the proxy generates self-signed certificates, the default certificate domain is "ligolo".
- frp defaults: the frp documentation's examples bind frps on port 7000 and its dashboard on 7500. Since v0.50.0 TLS is enabled by default; older or reconfigured clients may send the custom first byte 0x17 before the TLS handshake, which some network sensors can flag.
- Session shape: one outbound connection that stays up for hours or days with steady keepalives (Chisel defaults to a 25-second keepalive) and bidirectional volume, from a server that otherwise only talks to internal hosts and update services.
- Internal fan-out from one host: after the tunnel is up, scans and RDP, SMB or LDAP connections originate from the tunnel host to many internal targets. The CISA Volt Typhoon advisory recommends gait, a Zeek extension that records TCP options and timing, to help spot proxying, while noting that not every proxy it finds is malicious.
See the NDR Guide for long-connection and beaconing analytics.
Detection rules at a glance
| Rule | Data source | Fidelity | Tuning |
|---|---|---|---|
| Chisel subprotocol chisel-v3 | Proxy or NSM HTTP logs | High | None needed outside approved test ranges |
| Tunnel command-line grammar (client/server with -reverse or socks; -connect with -ignore-cert; frpc -c) | Process creation (Sysmon Event ID 1, Security 4688, auditd) | High | Exclude authorised penetration tests by host and window |
| New service whose binary sits in a writable path and connects outbound | System Event ID 7045 plus Sysmon Event ID 3 | Medium to high | Exclude signed vendor agents |
| Long-lived outbound session from a server to a never-seen destination | Firewall, NetFlow, Zeek conn logs | Medium | Baseline per host role; exclude backup and monitoring |
| Outdated browser user agent from a non-browser process | Proxy logs joined to EDR process data | Medium | Exclude known embedded clients |
| netsh interface portproxy changes | Process creation, registry (Sysmon Event ID 13) | Medium | Volt Typhoon used PortProxy alongside FRP |
See the Sigma Rules Guide for converting and testing these.
Where identity fits
Tunnels rarely arrive alone: they carry stolen credentials into the network. Volt Typhoon, per AA24-038A, relies mainly on valid accounts for persistence, and the tunnel is the transport for those logons. Once a tunnel is found, treat every authentication that originated from the tunnel host as suspect: review Kerberos and NTLM logons sourced from it, service account use, and any new accounts. frp's auth.token and Chisel's --auth credentials in recovered config files also identify the attacker's infrastructure. See the Identity Threat Hunting Guide.
Prevention and egress control
- Deny-by-default egress for servers: allow only named destinations through an explicit proxy (NIST SP 800-53 SC-7(5)). Direct outbound connections to arbitrary ports such as 7000, 8080 and 11601 should not be possible from a server segment.
- Proxy with category and age controls: block uncategorised and newly registered domains for server traffic, which removes most attacker-rented tunnel endpoints.
- Application control: block unsigned executables from writable paths such as C:\ProgramData, C:\Users\Public and C:\Windows\Temp on servers. See the App Control for Business (WDAC) guide.
- Harden pivot platforms: vCenter, hypervisor management and network appliances run tunnels where EDR cannot; restrict their egress and send their shell and process logs to the SIEM.
- Segment internal networks: a tunnel only reaches what its host can reach, so tier 0 and OT segments should not be routable from general servers.
Implementation: a phased rollout
- Map egress (week 1 to 2): list every server segment's outbound destinations from 30 days of firewall or flow logs. Mark anything direct to the internet that is not update, backup or monitoring.
- Telemetry (week 2): confirm process command lines, service installs, network connections and proxy logs are collected for servers and management platforms, including Linux appliances.
- Alert-mode rules (week 3 to 5): deploy the command-line, chisel-v3 and new-service rules first, then the long-session analytic. Record false positives and tune by host and account, not by disabling rules.
- Test (week 5): during an approved test window, have the red team or a lab run each tool, renamed, over TLS and WebSocket. Confirm which rules fire and how quickly.
- Enforce egress (week 6 to 12): move server segments to deny-by-default egress one segment at a time, with a monitored "log only" period first. Roll back a segment by restoring its previous rule set if a dependency breaks, then add the specific destination.
- Respond: on detection, block the remote endpoint, isolate the host, preserve the binary, config and memory, then hunt for internal connections from the host. Follow the Incident Response Guide.
Decision guidance
- Your red team uses these tools: keep the rules on and register test windows and hosts; an exercise that does not trip detection is a finding.
- Developers use frp or Chisel to expose local services: provide a sanctioned alternative such as an identity-aware proxy and ban the tools by policy. See the Identity-Aware Proxy Guide.
- Small organisation: server egress restriction on the firewall plus application control gives most of the value without full network monitoring.
- Large or critical infrastructure estate: add network sensors on server and management segments, TLS inspection where policy allows, and long-connection analytics.
Measuring whether it works
- Egress exposure: number of server segments with unrestricted outbound internet access.
- Detection test rate: share of quarterly tunnel emulations detected within 30 minutes.
- Long-session review: count of outbound sessions over 12 hours from servers that were reviewed and explained each week.
- Management platform coverage: percentage of hypervisor and appliance hosts sending process and network logs.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK | T1572 Protocol Tunneling, T1090 Proxy, T1090.001 Internal Proxy, T1090.002 External Proxy, T1095, S1144 FRP, T1036.005 | Behaviours to detect |
| MITRE D3FEND | D3-OTF Outbound Traffic Filtering, D3-NTA Network Traffic Analysis, D3-PMAD Protocol Metadata Anomaly Detection, D3-EAL Executable Allowlisting | Countermeasures |
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection, SC-7(5), SI-4(4) Inbound and Outbound Communications Traffic, CM-7(5) | Boundary, monitoring and software controls |
| NIST CSF 2.0 | PR.IR-01, DE.CM-01, DE.AE-02 | Protect networks, monitor and analyse events |
| CIS Controls v8.1 | 13.3 Deploy a Network Intrusion Detection Solution, 13.6 Collect Network Traffic Flow Logs, 2.5 Allowlist Authorized Software | Network monitoring and allowlisting |
| ISO/IEC 27001:2022 Annex A | 8.20 Networks security, 8.22 Segregation of networks, 8.16 Monitoring activities | Control objectives for audit |
Common failure patterns
- Name-based rules only: Volt Typhoon's FRP clients were renamed and UPX-packed, so a rule on frpc.exe would not have fired.
- Trusting port 443: Chisel and Ligolo-ng run happily on 443 with TLS; "outbound HTTPS is allowed" is exactly the gap they use.
- No visibility on appliances: tunnels on vCenter, network devices or monitoring servers such as PRTG sit outside EDR coverage.
- Removing the tunnel but not the access: the credentials used through the tunnel remain valid until reset. Reset every account and service credential used through the tunnel.
- Exempting penetration testing permanently: standing exclusions for test tools become the attacker's safe harbour.
Practitioner checklist
- Inventory server egress and close direct internet paths not needed for updates, backup or monitoring.
- Collect process command lines, service installs and network connections on servers and Linux appliances.
- Deploy the Chisel and frp Sigma rules and extend them with argument-based and behavioural rules.
- Alert on the chisel-v3 WebSocket subprotocol and outdated browser user agents from non-browser processes.
- Baseline and review long-lived outbound sessions from server segments weekly.
- Block unsigned executables in writable paths on servers.
- Test each tool quarterly, renamed and over TLS, and record detection times.
- After any tunnel finding, hunt authentications sourced from the tunnel host and reset affected credentials.
Standards and references
- MITRE ATT&CK: Protocol Tunneling (T1572)
- MITRE ATT&CK: FRP (S1144)
- CISA, NSA, FBI and partners: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
- CISA, FBI and MS-ISAC: #StopRansomware: Medusa Ransomware (AA25-071A)
- Ligolo-ng: Project repository and documentation
- Chisel: Project repository and documentation
- frp: Project repository and documentation
- SigmaHQ: Sigma detection rules repository
Related NHI Mgmt Group resources: T1572 Protocol Tunnelling Defensive Guide · Cloudflare Tunnel and trycloudflare abuse · Volt Typhoon Threat Actor Profile · Detecting RustDesk, MeshCentral and Tactical RMM Abuse · Detecting Rclone and File-Sync Exfiltration Tooling