Suspicious DNS Lookup to Known Tor Proxy Services
Detects DNS lookups to common Tor proxy gateways such as tor2web and onion.* mirrors. These domains are often used to proxy access to hidden services from non-Tor browsers and are frequently used by threat actors for staging, data exfiltration or ransomware payments.
Sigma
