ATT&CK T1090.003 - Tor Browser Proxy Port

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9150. This port is commonly used by Tor Browser for its SOCKS proxy, indicating potential use of Tor for anonymization or to bypass network restrictions. The rule specifically looks for the SYN flag in the TCP handshake, signifying the initiation of a connection.