Tor Client Process Launched on Windows Endpoint

Vignesh S@vigneshh

•updated yesterday•11•0•26

Detects Tor client execution on Windows endpoints, including the tor.exe binary and the Tor client bundled with Brave Browser (Private Window with Tor). Tor can hide command-and-control or exfiltration traffic, and some malware ships or drops a Tor client. To triage, check the parent process, image path, command line and SHA-256 hash, and confirm whether the user is authorized to use Tor.