Benign Binary Contacts Tor Exit Node
This rule detects when a known 'benign' binary, as identified by the Google Cloud Threat Intelligence (GCTI) Feed, initiates an outbound network connection to an IP address identified as a Tor exit node, also from the GCTI Feed. The rule also increases the risk score if the Tor exit node is located in specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria). This indicates potential malicious activity where an otherwise legitimate program might be compromised or used for covert communication.
YARA-L
