ATT&CK T1090 - Tor Network Traffic Detected
This rule detects potential Tor network traffic by looking for specific byte patterns (TLS handshake ClientHello with version 1.0 or 1.1) in TCP traffic flowing from the internal network to any external destination. It uses a threshold of 3 occurrences within 60 seconds from the same source IP to reduce false positives. The rule specifically targets the initial bytes of a TLS handshake, which is a common characteristic of Tor's encrypted communication.
Suricata
