CryptoBandits curl.exe C2 beacon via Tor SOCKS5 to .onion/route.php
Detects the use of 'curl.exe' with command-line arguments indicating communication through a SOCKS5 proxy on localhost:9050 to a .onion address. This pattern is often associated with Tor network usage for anonymized communication, which can be leveraged by adversaries for command and control or data exfiltration.
Microsoft Sentinel (KQL)
