Query Tor Onion Address - DNS Client

Title: Query Tor Onion Address - DNS Client
Status: test
Description:Detects DNS resolution of an .onion address related to Tor routing networks
References:
  -https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
  -https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-02-20
modified:2025-09-12
Tags:

• -'attack.command-and-control'
• -'attack.t1090.003'

Logsource:

• product: windows
• service: dns-client
• definition: Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.

Detection:
  selection:
    EventID: '3008'
    QueryName|endswith:
      -'.hiddenservice.net'
      -'.onion.ca'
      -'.onion.cab'
      -'.onion.casa'
      -'.onion.city'
      -'.onion.direct'
      -'.onion.dog'
      -'.onion.glass'
      -'.onion.gq'
      -'.onion.guide'
      -'.onion.in.net'
      -'.onion.ink'
      -'.onion.it'
      -'.onion.link'
      -'.onion.lt'
      -'.onion.lu'
      -'.onion.ly'
      -'.onion.mn'
      -'.onion.network'
      -'.onion.nu'
      -'.onion.pet'
      -'.onion.plus'
      -'.onion.pt'
      -'.onion.pw'
      -'.onion.rip'
      -'.onion.sh'
      -'.onion.si'
      -'.onion.to'
      -'.onion.top'
      -'.onion.ws'
      -'.onion'
      -'.s1.tor-gateways.de'
      -'.s2.tor-gateways.de'
      -'.s3.tor-gateways.de'
      -'.s4.tor-gateways.de'
      -'.s5.tor-gateways.de'
      -'.t2w.pw'
      -'.tor2web.ae.org'
      -'.tor2web.blutmagie.de'
      -'.tor2web.com'
      -'.tor2web.fi'
      -'.tor2web.io'
      -'.tor2web.org'
      -'.tor2web.xyz'
      -'.torlink.co'

  condition:selection
Falsepositives:
  -Unlikely
Level: high