Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Cactus – Chisel Tunnel Paired with Uncommon RMM Install (SuperOps/Splashtop)

Cactus Command and Control Sentinel
MITRE ATT&CK
Proxy
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (cactus)
What This Detects
Cactus deploys the Chisel TCP tunneling tool for C2/tunneling and has been observed installing less-common RMM agents (SuperOps, Splashtop) for hands-on-keyboard access – the pairing on one host in a short window is distinctive.
Query
let chiselRun = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has "chisel" or ProcessCommandLine has_any ("chisel client", "chisel server")
| project DeviceName, ChiselTime = Timestamp;
let rmmInstall = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has_any ("superops", "splashtop_streamer.exe", "srserver.exe")
| project DeviceName, RmmTime = Timestamp, RmmFile = FileName;
chiselRun
| join kind=inner rmmInstall on DeviceName
| where RmmTime - ChiselTime between (-2h .. 2h)
| project DeviceName, ChiselTime, RmmTime, RmmFile

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.