Attack Chain

1. An attacker gains initial access to a Windows endpoint (e.g., via phishing or exploitation).
2. The attacker downloads the TOR browser executable or a portable TOR client to the compromised system.
3. The attacker executes tor.exe or runs the TOR client from a directory such as *\BraveSoftware\Brave-Browser* or *\tor-*.
4. The TOR client establishes an encrypted connection to the TOR network.
5. The attacker uses the TOR browser or client to anonymize their network traffic.
6. The attacker may use the TOR network for command and control of malware, masking the origin of the C2 server.
7. The attacker may exfiltrate sensitive data through the TOR network, evading network-based data loss prevention (DLP) measures.

Impact

Successful execution of TOR clients within an organization can lead to masked command-and-control activity, data exfiltration, and evasion of security policies. The presence of TOR may indicate a compromised host being used for malicious purposes or an insider threat attempting to exfiltrate sensitive data anonymously. The number of affected systems and the extent of the damage depend on the attacker's objectives and the organization's security posture.

Recommendation

• Deploy the Sigma rule Detect Tor Executable Execution to detect the execution of tor.exe on endpoints.
• Deploy the Sigma rule Detect Tor Browser Path to detect the execution of TOR binaries from the Brave Browser or portable TOR installation paths.
• Investigate any alerts generated by these rules to determine the intent and scope of TOR usage (reference the Sigma rules above).
• Monitor network traffic for connections to known TOR entry nodes if possible (see references for lists of TOR nodes).