Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
1
1
1
1
1
Platforms
2
Products / Services
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query
Tor
KQL
This query looks for Tor client, or for a common Tor plugin called Meek.
We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents).
To read more about this technique, see:.
Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used.
Meek plugin: https://attack.mitre.org/wiki/Software/S0175.
Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188.
Tags: #Tor, #MultiHopProxy, #CnC.
We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents).
To read more about this technique, see:.
Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used.
Meek plugin: https://attack.mitre.org/wiki/Software/S0175.
Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188.
Tags: #Tor, #MultiHopProxy, #CnC.
