Tor Client/Browser Execution

Title: Tor Client/Browser Execution
Status: test
Description:Detects the use of Tor or Tor-Browser to connect to onion routing networks
References:
  -https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
Author: frack113
Date: 2022-02-20
modified:2025-10-27
Tags:

• -'attack.command-and-control'
• -'attack.t1090.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Description:'Tor Browser' Product:'Tor Browser'     - Image|endswith:
      - '\tor.exe'
      - '\Tor Browser\Browser\firefox.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high