↳ GitHub sourceAnalytics ruleLow

DNS events related to ToR proxies

View on GitHub ↗Original file ↗

Description

'Identifies IP addresses performing DNS lookups associated with common ToR proxies.'

Rule type: Scheduled
Version: 1.0.3
Declared status: Available
Query frequency: 1d
Query period: 1d
Trigger: gt 0

Declared MITRE coverage

Exfiltration T1048

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

DNS

Data types

DnsEvents

KQL query

Original query, unchanged.

DnsEvents
| where Name contains "."
| where Name has_any ("tor2web.org", "tor2web.com", "torlink.co", "onion.to", "onion.ink", "onion.cab", "onion.nu", "onion.link",
"onion.it", "onion.city", "onion.direct", "onion.top", "onion.casa", "onion.plus", "onion.rip", "onion.dog", "tor2web.fi",
"tor2web.blutmagie.de", "onion.sh", "onion.lu", "onion.pet", "t2w.pw", "tor2web.ae.org", "tor2web.io", "tor2web.xyz", "onion.lt",
"s1.tor-gateways.de", "s2.tor-gateways.de", "s3.tor-gateways.de", "s4.tor-gateways.de", "s5.tor-gateways.de", "hiddenservice.net")
| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)
| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"")

Declared entities

HostIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Windows Server DNS/Analytic Rules/DNS_TorProxies.yaml ↗
Commit: 9800e51 ↗
Source identifier: a83ef0f4-dace-4767-bce3-ebd32599d2a0

Additional source files 3

Solutions/Windows Server DNS/Analytic Rules/DNS_TorProxies.yamlsource ↗Detections/DnsEvents/DNS_TorProxies.yamlmigration-note ↗Solutions/Windows Server DNS/Data/Solution_DNS.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.