Potential TOR Network Usage - SOCKS5 Handshake on Non-Standard Port

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects outgoing TCP traffic that initiates a SOCKS5 handshake (indicated by the byte sequence |05 01 00|) on destination ports other than standard web ports (80, 443, 8080, 8443). This behavior is characteristic of TOR client traffic attempting to establish an anonymous connection to an external TOR relay or node via non-standard network ports.