DNS events related to ToR proxies (ASIM DNS Schema)
'Identifies IP addresses performing DNS lookups associated with common ToR proxies. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
Microsoft Sentinel (KQL)
