ATT&CK T1090.003 - Tor SOCKS Proxy Port Access

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9050, specifically looking for the SYN flag. Port 9050 is commonly associated with Tor SOCKS proxy services. This activity is classified as a policy violation and is linked to the MITRE ATT&CK technique T1090.003, which involves using a Tor proxy for defense evasion.