Tor

This query looks for Tor client, or for a common Tor plugin called Meek. We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents). To read more about this technique, see:. Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used. Meek plugin: https://attack.mitre.org/wiki/Software/S0175. Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188. Tags: #Tor, #MultiHopProxy, #CnC.