AWS GuardDuty Tor Network Activity Detected

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•0•34

This rule detects activity associated with the Tor network within an AWS account, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings related to TorIPCaller, TorRelay, or TorClient, indicating potential use of Tor for anonymization or command and control.