Detection of Tor Onion Service DNS Resolution
This detection identifies Windows DNS Client events associated with Tor routing or Tor2Web proxy services, which are often used for anonymous command and control (C2) communication.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 02:41 UTC
- Detection
- 1 rule
- Source quality
- A1Likely
This brief documents a detection capability for identifying systems attempting to resolve Tor-related domains via standard Windows DNS resolution. Malicious actors frequently leverage Tor hidden services or Tor2Web proxies to anonymize C2 traffic and bypass traditional network perimeter defenses. The detection relies on Windows DNS Client operational logs to identify queries for domains that map to the Tor network.
Recommendation
- Enable the "Microsoft-Windows-DNS Client Events/Operational" log channel on all Windows endpoints to ensure these events are captured.
- Deploy the provided Sigma rule to your SIEM to monitor for DNS queries targeting Tor-related suffixes.
- Investigate any host triggering this rule to determine if the activity is originating from authorized Tor browser usage or potentially malicious C2 beaconing.
Immediate actions
Enable Microsoft-Windows-DNS Client operational logging
Threat Hunt
Querying of non-standard TLDs indicative of Tor proxies
Data: DNS query logs
Mitigations
Implement DNS filtering to block known malicious Tor2Web proxies
Tor proxy domains
Detection coverage 1
Detect DNS Resolution of Tor Onion and Proxy Domains
highDetects DNS resolution of .onion addresses and known Tor2Web proxy suffixes potentially indicating C2 communication or anonymous browsing.
Detection queries are available on the platform. Get full rules →