DNS Lookups to Tor Proxies and Services
This rule identifies DNS lookups associated with common Tor proxies and services. It detects queries for domains ending in '.onion' and various Tor gateway domains (e.g., '.hiddenservice.net', '.tor2web.com', '.tor-gateways.de'). This activity can indicate the use of the Tor network for anonymization, which adversaries may leverage for command and control, data exfiltration, or to obscure their malicious activities.
Sigma
