Tor and anonymizing proxy usage in a corporate environment indicates one of three scenarios: a user bypassing content policy (low risk, policy violation), an insider threat conducting covert exfiltration under anonymized cover (high risk), or malware using Tor as a built-in C2 anonymization layer (high risk — Tor-routing malware includes some Cobalt Strike configurations, OnionDuke, and custom implants by nation-state APTs). The key context clue is which process is connecting to Tor — a user's browser connecting to Tor Browser ports is a policy issue; svchost.exe or a random binary connecting to Tor exit nodes is a malware indicator.
Key data sources: ASimNetworkSession (ASIM-normalized flows — check DstIpAddr against Tor exit node list), DeviceNetworkEvents (MDE — process-level Tor connection attribution), DnsEvents (.onion domain queries), ThreatIntelligenceIndicator (Tor exit node IPs from abuse.ch/dan.me.uk TAXII feeds).
☰ Table of Contents
01 — BACKGROUND
TECHNIQUE OVERVIEWMITRE T1090.003 (Multi-hop Proxy) covers Tor, I2P, and commercial VPN chaining used by attackers to anonymize C2 traffic. Tor routes traffic through three onion relay nodes before exiting — the exit node IP is the only visible destination from corporate network telemetry. Tor relay ports are 9001 (OR port — relay-to-relay) and 9030 (Dir port — directory service). Tor Browser uses 9150 (SOCKS proxy) locally. The Tor exit node list is public and maintained by several threat intelligence sources (dan.me.uk, torproject.org consensus, abuse.ch) — matching your outbound connections against this list gives near-certain detection. Commercial VPNs (Mullvad, ProtonVPN, NordVPN, ExpressVPN) operate from known ASNs and IP ranges, and connections to these ASNs from corporate endpoints may indicate policy bypass or insider threat activity.
| Field | Value |
|---|---|
| MITRE Techniques | T1090 — Proxy T1090.003 — Proxy: Multi-hop Proxy (Tor, I2P) |
| Kill-chain Phase | Command & Control (Tor C2) / Exfiltration (anonymized exfil) |
| Primary Log Sources | ASimNetworkSession, DeviceNetworkEvents, DnsEvents |
| Tor Exit Node Sources | ThreatIntelligenceIndicator (abuse.ch feed), dan.me.uk/torlist (HTTP API), Cisco Talos Tor exit list, torproject.org consensus download |
| Known Tor Ports | 9001 (OR relay), 9030 (Dir), 9050 (SOCKS local), 9051 (control), 9150 (Tor Browser SOCKS) |
| Default Severity | Browser/user-initiated Tor: SEV3 (policy violation). Non-browser process Tor: SEV2 (malware suspected). .onion DNS query: SEV2. |
The Tor exit node list rotates daily as nodes come online and go offline. Subscribe a Sentinel watchlist to the Tor exit node list via a Logic App or Azure Function that fetches the list daily from dan.me.uk/torlist?full=1 — this keeps your detection current without manual updates. A stale Tor exit node list misses newly active exit nodes.
02 — IDENTIFICATION
2 INDICATORSTor exit nodes maintain their own circuit — when your endpoint connects to a Tor exit node, all subsequent traffic is routed through the Tor network. The exit node IP is the only visible network artefact; destination sites see the exit node as the source. Detection relies on matching outbound destination IPs against the current Tor exit node list. Connections to port 9001 (Tor OR port) indicate the endpoint is connecting to a Tor relay directly — used by Tor Browser and some malware. Port 9030 connections indicate Tor directory lookups — the client building its circuit map. Both are unambiguous indicators of Tor usage.
- 1Run the Tor exit node match query. If you have a Tor exit node watchlist in Sentinel, use the
_GetWatchlist('TorExitNodes')function to join. Alternatively, join against ThreatIntelligenceIndicator where the feed is abuse.ch or torproject-consensus and ThreatType = "Proxy". - 2For each matching connection, check
InitiatingProcessFileNamein DeviceNetworkEvents —tor.exeorfirefox.exewith the Tor Browser bundle parent path indicates user-initiated Tor use. Any other process (especiallysvchost.exe, random binary names,powershell.exe) indicates malware-driven Tor C2. - 3Check if the initiating process path is in
%AppData%\Tor Browser\,%ProgramFiles%\Tor\, or%TEMP%. Tor Browser in TEMP is a red flag for dropped-and-run malware component; legitimate user Tor Browser installs are typically in%Desktop%\Tor Browser\or%AppData%\. - 4For .onion DNS query detection, run the DnsEvents query — DNS queries for .onion domains from non-Tor Browser processes indicate malware attempting to resolve Tor hidden services. Note: standard Tor doesn't use external DNS for .onion — this indicates a misconfigured tunnel or special Tor-over-DNS setup.
| Indicator | Meaning | Severity |
|---|---|---|
| Outbound to Tor exit node IP, port 443 | Tor HTTPS exit — anonymous browsing or C2 over Tor; check process attribution | MEDIUM–HIGH |
| Outbound port 9001 to external IP | Direct Tor OR relay connection — circuit building; confirms Tor client active on host | HIGH |
| Outbound port 9030 to external IP | Tor directory authority query — Tor client fetching relay consensus; confirms Tor use | MEDIUM |
| DNS query for *.onion domain | Tor hidden service lookup — either Tor Browser user or malware targeting dark web C2 | MEDIUM |
| Non-browser process to Tor exit node | Malware routing C2 traffic over Tor — higher severity; isolate host | HIGH |
Commercial VPN providers (Mullvad AS39351, NordVPN AS54182, ExpressVPN AS59253, ProtonVPN AS62371, Surfshark AS215859) operate from known Autonomous System Numbers. Connections to IPs within these ASNs from corporate endpoints indicate either policy bypass (employee using VPN) or data exfiltration under VPN cover (insider threat or malware). Unlike Tor, commercial VPN traffic runs on standard HTTPS (port 443) and WireGuard (port 51820), making it harder to identify by port alone — ASN enrichment is the primary detection method. GeoIP anomalies (connection to VPN server geolocation inconsistent with user's expected location) provide an additional signal.
- 1Run the VPN ASN detection query. The query uses an enrichment table of known VPN provider ASNs joined against outbound network flows. If your environment has an IP-to-ASN enrichment (via the GeoIP lookup tables in Sentinel or a custom watchlist), use it to filter connections to VPN ASNs.
- 2For WireGuard VPN detection: filter for UDP port 51820 outbound — this is the default WireGuard port used by Mullvad, ProtonVPN, and others. UDP 1194 is OpenVPN. TCP 1723 is PPTP (legacy). TCP 443 with WireGuard or OpenVPN handshake is the hardest to detect without DPI.
- 3Correlate VPN connections with large data transfers — a user connecting to a commercial VPN and then generating >100 MB outbound is a potential data exfiltration scenario, particularly if this is outside normal working hours or from an account with access to sensitive data.
- 4For insider threat context: check the user's HR status (under PIP, recently resigned, dispute with management) via HR system integration if available. VPN usage + large transfer + abnormal user status = insider threat indicator requiring HR and Legal involvement.
| Indicator | Meaning | Risk |
|---|---|---|
| Outbound UDP 51820 (WireGuard) | WireGuard VPN tunnel — Mullvad, ProtonVPN, NordVPN use this port by default | MEDIUM |
| Outbound UDP 1194 (OpenVPN) | OpenVPN tunnel — classic commercial VPN protocol | MEDIUM |
| Connection to known VPN ASN + large transfer | VPN-covered data exfiltration — user routing sensitive data through commercial VPN | HIGH |
| Proxy tool process (proxychains, privoxy, socat) | Proxy chaining software — deliberate traffic obfuscation; insider threat indicator | HIGH |
Before escalating VPN detections as insider threat, confirm whether your organisation has an approved commercial VPN policy for remote workers. Some organisations explicitly permit personal VPN use. Check your acceptable use policy — if commercial VPN is permitted, tune the alert to exclude policy-compliant usage and focus detection on anomalous transfer volumes or after-hours activity.
03 — CONTAINMENT
DECISION + ACTIONS- 1Firewall block — Tor ports: Add deny rules for TCP/UDP 9001, 9030, 9050, 9051, 9150 outbound at the perimeter firewall. These ports have no legitimate corporate use case.
- 2VPN protocol block: Block UDP 51820 (WireGuard), UDP 1194 (OpenVPN), and TCP 1723 (PPTP) outbound unless your policy explicitly permits commercial VPN use. These protocols have no corporate justification on endpoints that already have corporate VPN.
- 3DNS sinkhole for .onion: Add a DNS block for the
.onionTLD on your corporate DNS resolvers. This prevents all Tor hidden service resolution from corporate endpoints with zero false positive risk — .onion is not a legitimate corporate TLD.
04 — ERADICATION
CLEANUP & RECOVERY- 1Tor Binary removal: Use MDE Live Response to locate all Tor-related binaries — search for
tor.exe,libssl-1.1.dll(bundled with Tor Browser), and any directory namedTor BrowserorTor. Delete all found instances. For malware-delivered Tor, also remove the parent implant per SOP-34 procedure. - 2Watchlist maintenance: Update the Tor exit node watchlist with current exit node IPs. Stale watchlists miss newly active exit nodes. Schedule an automated daily refresh from the Tor Project consensus download or dan.me.uk/torlist API.
- 3DNS-over-HTTPS consideration: Tor Browser increasingly uses DNS-over-HTTPS (DoH) to bypass corporate DNS monitoring for .onion lookups. If your organisation hasn't blocked DoH (port 443 to 8.8.8.8, 1.1.1.1, and 9.9.9.9 specifically for DoH queries), consider implementing a DoH-aware proxy to maintain DNS visibility.
- 4Insider threat assessment: If Tor was user-initiated and large data volumes were transferred, engage Legal and HR for an insider threat investigation. Preserve all logs under legal hold before notifying the user — notification before preservation risks evidence destruction.
05 — ESCALATION
THRESHOLDS & CONTACTS| Condition | Action | Severity |
|---|---|---|
| Non-browser process connecting to Tor exit nodes | Escalate to SOC Lead — malware using Tor C2; isolate host; invoke IR playbook | SEV2 |
| Tor connection + confirmed malware + data exfil suspected | Escalate to CISO + Legal — Tor anonymizes exfil destination; breach notification assessment required | SEV1 |
| User Tor Browser + large outbound transfer + sensitive data access | Escalate to SOC Lead + HR + Legal — potential insider threat; preserve all evidence before notifying user | SEV2 |
| User Tor Browser, no data exfil evidence | Policy violation — notify manager + HR; block Tor at endpoint; no SOC escalation needed | SEV3 |
| VPN usage with large data transfer after-hours | Escalate to SOC Lead — potential insider data theft; check access logs for data repositories accessed | SEV2 |
CyberHawk Threat Intel
Built by Rudra Verma | Senior Cyber Security Architect & Researcher
"They can't exploit you if you are the Exploit."
Authorized security research & penetration testing only. Unauthorized use is illegal.