Skip to content
Threat Feed
Subscribe
high advisory

DNS query for Tor onion domains

Detection of anomalous DNS queries to .onion addresses and Tor-to-web proxy services, which may indicate unauthorized network routing or C2 activity.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 10, 15:08 UTC
Detection
1 rule
Source quality
A1Roughly even chance

This intelligence identifies specific DNS query patterns associated with Tor network resolution, including direct '.onion' TLD requests and the use of Tor-to-web gateway services. These domains facilitate access to anonymized services from standard internet environments. Monitoring these requests is a common mechanism for identifying the use of anonymization tools that may bypass organizational network security controls or facilitate command and control (C2) communication.

Recommendation

  • Enable Sysmon DNS Query logging (Event ID 22) to capture domain resolution attempts.
  • Deploy the provided Sigma rule to detect and alert on these resolution patterns.
  • Investigate the originating process and host identity for any alert triggers, as legitimate Tor browser usage or malicious proxying may occur.
  • Implement a DNS filtering blocklist for known Tor2Web proxy domains if such resolution is prohibited by organizational policy.

Immediate actions

Deploy Sigma rule to SIEM

Detection Engineering 48h

Threat Hunt

Identify endpoints querying high volumes of Tor-related domains

T1090.003 medium medium confidence hunt now

Data: DNS logs, Proxy logs

Detection coverage 1

Detect DNS Query for Tor Onion Domains

high

Detects DNS queries for .onion addresses and known Tor-to-web gateway domains that facilitate Tor network access

sigma tactics: command-and-control techniques: T1090.003 sources: dns_query, windows

Detection queries are available on the platform. Get full rules →