Tor Proxy Activity via torsocks Process
This rule looks for the usage of the torsocks process which can be used by threat actors to proxy connections through the Tor network to exfiltrate data or download further payloads. The usage of this process should always be considered suspicious.
Sigma
