SystemBC Outbound Connection to Tor Directory Authority IPs

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects successful outbound network connections from an endpoint to a known Tor directory authority IP address. Establishing a connection to these authorities is a strong indicator that the system is attempting to join the Tor network or is interacting with Tor infrastructure, which may be unauthorized in enterprise environments.