Network traffic referencing underground ransomware/crypter sales .onion domain
Detects outbound network traffic to a specific .onion domain associated with underground ransomware or crypter sales. This suggests potential interaction with C2 or malicious infrastructure hosted via the Tor network.
Suricata
