Tor relay torrc ExitPolicy rewritten to Ebury Policy A/B reject lists
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Microsoft Sentinel (KQL)

