Tor Activity to the Internet

This rule detects network events that may indicate the use of Tor traffic to the Internet. Tor is a network protocol that sends traffic through a series of encrypted tunnels used to conceal a user's location and usage. Tor may be used by threat actors as an alternate communication pathway to conceal the actor's identity and avoid detection.

Rule type: query
Rule indices:

• filebeat-*
• packetbeat-*
• logs-endpoint.events.*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

• Elastic
• Host
• Network
• Threat Detection
• Command and Control

Version: 100
Rule authors:

• Elastic

Rule license: Elastic License v2

event.category:(network or network_traffic) and network.transport:tcp and destination.port:(9001 or 9030) and
  source.ip:(10.0.0.0/8 or
             172.16.0.0/12 or
             192.168.0.0/16) and

  not destination.ip:(10.0.0.0/8 or
                      127.0.0.0/8 or
                      169.254.0.0/16 or
                      172.16.0.0/12 or
                      192.168.0.0/16 or
                      224.0.0.0/4 or
                      "::1" or
                      "FE80::/10" or
                      "FF00::/8")
		

Framework: MITRE ATT&CK

• Tactic:

  • Name: Command and Control
  • Id: TA0011
  • Reference URL: https://attack.mitre.org/tactics/TA0011/

• Technique:

  • Name: Proxy
  • Id: T1090
  • Reference URL: https://attack.mitre.org/techniques/T1090/

• Sub Technique:

  • Name: Multi-hop Proxy
  • Id: T1090.003
  • Reference URL: https://attack.mitre.org/techniques/T1090/003/