Tor Client or Tor Browser Execution
This rule detects the execution of the Tor client or Tor Browser, which are used to connect to the Tor anonymity network. Specifically, it looks for process creation events where the image path ends with '\tor.exe' or '\Tor Browser\Browser\firefox.exe'. This indicates an attempt to establish an anonymous connection, potentially for malicious command and control, data exfiltration, or to bypass network restrictions.
Sigma
