Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
This query looks for Tor client, or for a common Tor plugin called Meek. We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents). To read more about this technique, see:. Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used. Meek plugin: https://attack.mitre.org/wiki/Software/S0175. Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188. Tags: #Tor, #MultiHopProxy, #CnC.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | GitHub Only |
| ID | a0b19966-3b4d-45de-969c-ee5f1ef8c18a |
| Required Connectors | MicrosoftThreatProtection |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
DeviceNetworkEvents |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊