Suspicious Tor Daemon Execution with Custom Configuration
Detects instances of the Tor daemon executing with custom torrc configurations outside of the standard Tor Browser directory. This behavior is often associated with malware like IronWorm, which downloads the Tor expert bundle, writes its own torrc, and starts the daemon to tunnel C2 traffic.
Microsoft Sentinel (KQL)
