Tor relay torrc modified to accept port 22 exit policy with mail port changes
Detects modifications to the Tor configuration file (torrc) that permit SSH traffic (port 22) in the exit policy, followed by a Tor service reload or restart on the same device within a 4-hour window. This behavior may indicate an adversary setting up an onion routing proxy or covert tunnel.
Microsoft Sentinel (KQL)
