DNS Query Tor .Onion Address - Sysmon

Title: DNS Query Tor .Onion Address - Sysmon
Status: test
Description:Detects DNS queries to an ".onion" address related to Tor routing networks
References:
  -https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
  -https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml
Author: frack113
Date: 2022-02-20
modified:2025-09-12
Tags:

• -'attack.command-and-control'
• -'attack.t1090.003'

Logsource:

• product: windows
• category: dns_query

Detection:
  selection:
    QueryName|endswith:
      -'.hiddenservice.net'
      -'.onion.ca'
      -'.onion.cab'
      -'.onion.casa'
      -'.onion.city'
      -'.onion.direct'
      -'.onion.dog'
      -'.onion.glass'
      -'.onion.gq'
      -'.onion.ink'
      -'.onion.it'
      -'.onion.link'
      -'.onion.lt'
      -'.onion.lu'
      -'.onion.nu'
      -'.onion.pet'
      -'.onion.plus'
      -'.onion.rip'
      -'.onion.sh'
      -'.onion.to'
      -'.onion.top'
      -'.onion'
      -'.s1.tor-gateways.de'
      -'.s2.tor-gateways.de'
      -'.s3.tor-gateways.de'
      -'.s4.tor-gateways.de'
      -'.s5.tor-gateways.de'
      -'.t2w.pw'
      -'.tor2web.ae.org'
      -'.tor2web.blutmagie.de'
      -'.tor2web.com'
      -'.tor2web.fi'
      -'.tor2web.io'
      -'.tor2web.org'
      -'.tor2web.xyz'
      -'.torlink.co'

  condition:selection
Falsepositives:
  -Unknown
Level: high