Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
18
10
9
7
2
Contributors
8
5
5
4
4
Categories
18
13
10
8
8
Platforms
26
12
8
3
2
Products / Services
13
6
5
5
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
Detects the execution of the Tor executable or the launching of Tor Browser from Brave Browser. The detection also identifies command-line arguments associated with Tor configuration files and Control/SOCKS ports, providing visibility into potential Tor usage on Windows endpoints for further investigation.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
This rule detects outgoing TCP traffic that initiates a SOCKS5 handshake (indicated by the byte sequence |05 01 00|) on destination ports other than standard web ports (80, 443, 8080, 8443). This behavior is characteristic of TOR client traffic attempting to establish an anonymous connection to an external TOR relay or node via non-standard network ports.
This rule identifies outbound network connections from devices to public IP addresses using ports commonly associated with the Tor network (9001, 9030, 9050, 9051). These ports are frequently used for Tor relay, bridge, and control functionality, and connections to them from managed endpoints may indicate unauthorized use of the Tor network for anonymity or malicious command-and-control communication.
This rule detects outgoing TCP traffic that initiates a SOCKS5 handshake (indicated by the byte sequence |05 01 00|) on destination ports other than standard web ports (80, 443, 8080, 8443). This behavior is characteristic of TOR client traffic attempting to establish an anonymous connection to an external TOR relay or node via non-standard network ports.
This rule identifies outbound network connections from devices to public IP addresses using ports commonly associated with the Tor network (9001, 9030, 9050, 9051). These ports are frequently used for Tor relay, bridge, and control functionality, and connections to them from managed endpoints may indicate unauthorized use of the Tor network for anonymity or malicious command-and-control communication.
Detects network, proxy, or DNS activity associated with .onion pseudo-top-level domains, which are typically used for Tor anonymity services. The rule distinguishes between generic access to the Tor network and specific high-confidence interactions with known malicious onion addresses associated with payout or extortion sites.
This rule identifies potential use of the Tor network by detecting network connections to common Tor relay ports (9001, 9030, 9050, 9051, 9150) that are external to internal subnets, or by identifying DNS requests for .onion domains.
This rule detects outbound network traffic from internal IP addresses to known Tor network entry or exit relay ports (9001, 9030, 9050, 9051). It specifically prioritizes alerts where the source host is identified as network infrastructure (routers, gateways, firewalls) or IoT devices, flagging potential unauthorized use of Tor for obfuscated communication or data exfiltration from within the network perimeter.
Detects the use of 'curl.exe' with command-line arguments indicating communication through a SOCKS5 proxy on localhost:9050 to a .onion address. This pattern is often associated with Tor network usage for anonymized communication, which can be leveraged by adversaries for command and control or data exfiltration.
Detects the usage of curl.exe routing traffic through a local SOCKS5 proxy on port 9050, a behavior observed in CryptoBandits malware communicating with a bundled Tor client to hide its Command and Control (C2) destination.
Detects use of Tor network for anonymous C2 communications
Detects use of Tor network proxy ports for anonymous C2 communications
Detects instances of the Tor daemon executing with custom torrc configurations outside of the standard Tor Browser directory. This behavior is often associated with malware like IronWorm, which downloads the Tor expert bundle, writes its own torrc, and starts the daemon to tunnel C2 traffic.
This rule detects network connections initiated by 'tor.exe' or 'meek-client.exe', indicating potential use of the Tor anonymity network. It enriches the events with process and certificate information to provide context about the initiating process and its trust status.
A Tor exit node is the last server in the Tor network that your traffic passes through before it reaches the public internet so it is the one that actually makes the connection to website.
In this particular query, I am getting the devices with connections to Tor Exit Nodes, to list to which node are connecting and possible suspicious URLs with connections to the mentioned servers.
In this particular query, I am getting the devices with connections to Tor Exit Nodes, to list to which node are connecting and possible suspicious URLs with connections to the mentioned servers.
Detects outbound network connections to a specific .onion domain associated with the 'Tsunami Payload' component of the 'Contagious Interview' campaign, which uses the Tor network for command and control (C2) communications.
Page 1 of 3