Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
18
10
9
7
2
Contributors
8
5
5
4
4
Categories
18
13
10
8
8
Platforms
26
12
8
3
2
Products / Services
13
6
5
5
4
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
2
IDS Protocols
2
This rule detects when a file, identified by its SHA256 hash, initiates a network connection to an IP address that is identified as a Tor exit node. The rule leverages VirusTotal relationships to link the file hash to the contacted IP address and Google Cloud Threat Intelligence (GCTI) Feed to identify Tor exit nodes. The risk score is increased if the Tor IP's geolocation is in certain countries (Cuba, Iran, North Korea, Russia, Syria).
Detects when a GitHub Personal Access Token (PAT) is created from an IP address identified as a Tor exit node. This activity is suspicious because adversaries often use Tor to anonymize their network traffic when performing malicious actions, such as establishing persistence or exfiltrating data. The creation of a PAT from a Tor IP could indicate an attacker attempting to gain persistent access to a GitHub account or repository before carrying out further actions like cloning repositories to steal data.
This rule detects successful AWS API calls originating from an IP address identified as a Tor exit node. It leverages a GCTI Feed for Tor exit node IP listings and also calculates a risk score based on the geographical location of the originating IP, specifically increasing the score for connections from Cuba, Iran, North Korea, Russia, and Syria.
This rule detects successful API executions within Google Cloud Platform (GCP) that originate from an IP address identified as a Tor exit node. It correlates GCP Cloud Audit logs, specifically looking for 'ALLOW' actions, with a GCTI (Google Cloud Threat Intelligence) feed that lists known Tor exit node IP addresses. The rule also calculates a risk score, with additional weight given if the originating IP is from certain high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
This rule detects activity associated with the Tor network within an AWS account, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings related to TorIPCaller, TorRelay, or TorClient, indicating potential use of Tor for anonymization or command and control.
This rule detects the execution of the Tor client or Tor Browser, which are used to connect to the Tor anonymity network. Specifically, it looks for process creation events where the image path ends with '\tor.exe' or '\Tor Browser\Browser\firefox.exe'. This indicates an attempt to establish an anonymous connection, potentially for malicious command and control, data exfiltration, or to bypass network restrictions.
Page 3 of 3