SOP-36: Tor Anonymizing Proxy and VPN Detection Response

SOC analyst SOP for Tor exit node, anonymizing proxy, and VPN usage detection. Covers ASN-based detection, exit node IP watchlists, and C2 over Tor.