Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
122 detections
Filters
Last updated
All Time
Detection languages
37
23
21
14
8
Contributors
32
11
10
9
9
Categories
53
43
28
23
18
Platforms
66
34
22
14
9
Products / Services
24
22
21
18
16
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
10
5
3
2
1
IDS Protocols
12
3
3
2
1
Detects the Skynet malware's specific behavior of dropping and executing a Tor client with unique command-line arguments in the temporary directory.
Detects the use of Tor or Tor-Browser to connect to onion routing networks
Tor
KQL
This query looks for Tor client, or for a common Tor plugin called Meek.
We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents).
To read more about this technique, see:.
Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used.
Meek plugin: https://attack.mitre.org/wiki/Software/S0175.
Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188.
Tags: #Tor, #MultiHopProxy, #CnC.
We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents).
To read more about this technique, see:.
Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used.
Meek plugin: https://attack.mitre.org/wiki/Software/S0175.
Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188.
Tags: #Tor, #MultiHopProxy, #CnC.
Detects the use of Tor or Tor-Browser to connect to onion routing networks
Detects DNS resolution of an .onion address related to Tor routing networks
Detects DNS queries to an ".onion" address related to Tor routing networks
This rule detects when a file, identified as malicious by Google Safe Browsing, initiates an outbound network connection to an IP address known to be a Tor Exit Node, as identified by Google Cloud Threat Intelligence (GCTI) Feed. This indicates potential command and control (C2) communication or data exfiltration by malware attempting to anonymize its network traffic.
This rule detects outbound network connections to known Tor exit nodes. It leverages a Google Cloud Threat Intelligence (GCTI) feed that provides a list of current Tor exit node IP addresses. The rule specifically looks for allowed network connections where the target IP address is identified as a Tor exit node by the GCTI feed. This can indicate an attempt to anonymize network traffic, which is often associated with malicious activity.
This rule detects when a known 'benign' binary, as identified by the Google Cloud Threat Intelligence (GCTI) Feed, initiates an outbound network connection to an IP address identified as a Tor exit node, also from the GCTI Feed. The rule also increases the risk score if the Tor exit node is located in specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria). This indicates potential malicious activity where an otherwise legitimate program might be compromised or used for covert communication.
This rule detects when a file, identified by its SHA256 hash, initiates a network connection to an IP address that is identified as a Tor exit node. The rule leverages VirusTotal relationships to link the file hash to the contacted IP address and Google Cloud Threat Intelligence (GCTI) Feed to identify Tor exit nodes. The risk score is increased if the Tor IP's geolocation is in certain countries (Cuba, Iran, North Korea, Russia, Syria).
GCTI Tor Exit Nodes
YARA-L
Alert traffic destined for known Tor exit nodes
Alert on known Hash contacting Tor IP with VT Relationships.
Alert on Benign Binary contacting a TOR IP
A malicious file contacting a known Tor Exit Node.
This rule detects activity associated with the Tor network within an AWS account, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings related to TorIPCaller, TorRelay, or TorClient, indicating potential use of Tor for anonymization or command and control.
Amazon GuardDuty detects Tor Network activity in an AWS account.
This rule detects the execution of the Tor client or Tor Browser, which are used to connect to the Tor anonymity network. Specifically, it looks for process creation events where the image path ends with '\tor.exe' or '\Tor Browser\Browser\firefox.exe'. This indicates an attempt to establish an anonymous connection, potentially for malicious command and control, data exfiltration, or to bypass network restrictions.
Page 6 of 6