DNS Query to Tor .Onion Address or Tor2web Proxy

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2025•0•26

Detects DNS queries to an ".onion" address or other domains associated with Tor routing networks and Tor2web proxies. This indicates potential use of Tor for anonymous communication or access to dark web services.