DNS TOR Proxies

Title: DNS TOR Proxies
Status: test
Description:Identifies IPs performing DNS lookups associated with common Tor proxies.
References:
  -https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml
Author: Saw Winn Naung , Azure-Sentinel
Date: 2021-08-15
modified:2025-09-12
Tags:

• -'attack.exfiltration'
• -'attack.t1048'

Logsource:

• service: dns
• product: zeek

Detection:
  selection:
    query|endswith:
      -'.hiddenservice.net'
      -'.onion.ca'
      -'.onion.cab'
      -'.onion.casa'
      -'.onion.city'
      -'.onion.direct'
      -'.onion.dog'
      -'.onion.glass'
      -'.onion.gq'
      -'.onion.guide'
      -'.onion.in.net'
      -'.onion.ink'
      -'.onion.it'
      -'.onion.link'
      -'.onion.lt'
      -'.onion.lu'
      -'.onion.ly'
      -'.onion.mn'
      -'.onion.network'
      -'.onion.nu'
      -'.onion.pet'
      -'.onion.plus'
      -'.onion.pt'
      -'.onion.pw'
      -'.onion.rip'
      -'.onion.sh'
      -'.onion.si'
      -'.onion.to'
      -'.onion.top'
      -'.onion.ws'
      -'.onion'
      -'.s1.tor-gateways.de'
      -'.s2.tor-gateways.de'
      -'.s3.tor-gateways.de'
      -'.s4.tor-gateways.de'
      -'.s5.tor-gateways.de'
      -'.t2w.pw'
      -'.tor2web.ae.org'
      -'.tor2web.blutmagie.de'
      -'.tor2web.com'
      -'.tor2web.fi'
      -'.tor2web.io'
      -'.tor2web.org'
      -'.tor2web.xyz'
      -'.torlink.co'

  condition:selection
Falsepositives:
  -Unknown
Level: medium