Anti-analysis check.torproject.org probe combined with machine-id/board-serial fingerprinting
Detects potential anonymization attempts by identifying systems that connect to the Tor network check service followed closely by processes accessing local machine identifiers, such as machine-id or board serial numbers. This behavior may indicate an actor attempting to verify anonymity or fingerprint a host while routing traffic through Tor.
Microsoft Sentinel (KQL)
