DNS Query for Tor Onion Address or Tor2web Gateway

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2025•0•30

This rule detects DNS resolution attempts for domains associated with Tor onion services and Tor2web gateways. It specifically looks for DNS queries ending with various Tor-related top-level domains and subdomains, indicating potential use of the Tor network for anonymization or accessing hidden services.