Tor Network Activity Detected

Information hacker@Informationhacker

•updated Jan 13, 2026•51•1•270

This rule detects network connections initiated by 'tor.exe' or 'meek-client.exe', indicating potential use of the Tor anonymity network. It enriches the events with process and certificate information to provide context about the initiating process and its trust status.