detection.wiki

Detection rules › Sigma

Query Tor Onion Address - DNS Client

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects DNS resolution of an .onion address related to Tor routing networks

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1090.003 Proxy: Multi-hop Proxy

Event coverage

ProviderEvent IDTitle
DNS-Client3008DNS query is completed for the name QueryName, type QueryType, query options QueryOptions with status QueryStatus Results QueryResults.

Stages and Predicates

Stage 1: selection

or:
QueryName|endswith: .hiddenservice.net
QueryName|endswith: .onion
QueryName|endswith: .onion.ca
QueryName|endswith: .onion.cab
QueryName|endswith: .onion.casa
QueryName|endswith: .onion.city
QueryName|endswith: .onion.direct
QueryName|endswith: .onion.dog
QueryName|endswith: .onion.glass
QueryName|endswith: .onion.gq
QueryName|endswith: .onion.guide
QueryName|endswith: .onion.in.net
QueryName|endswith: .onion.ink
QueryName|endswith: .onion.it
QueryName|endswith: .onion.link
QueryName|endswith: .onion.lt
QueryName|endswith: .onion.lu
QueryName|endswith: .onion.ly
QueryName|endswith: .onion.mn
QueryName|endswith: .onion.network
QueryName|endswith: .onion.nu
QueryName|endswith: .onion.pet
QueryName|endswith: .onion.plus
QueryName|endswith: .onion.pt
QueryName|endswith: .onion.pw
QueryName|endswith: .onion.rip
QueryName|endswith: .onion.sh
QueryName|endswith: .onion.si
QueryName|endswith: .onion.to
QueryName|endswith: .onion.top
QueryName|endswith: .onion.ws
QueryName|endswith: .s1.tor-gateways.de
QueryName|endswith: .s2.tor-gateways.de
QueryName|endswith: .s3.tor-gateways.de
QueryName|endswith: .s4.tor-gateways.de
QueryName|endswith: .s5.tor-gateways.de
QueryName|endswith: .t2w.pw
QueryName|endswith: .tor2web.ae.org
QueryName|endswith: .tor2web.blutmagie.de
QueryName|endswith: .tor2web.com
QueryName|endswith: .tor2web.fi
QueryName|endswith: .tor2web.io
QueryName|endswith: .tor2web.org
QueryName|endswith: .tor2web.xyz
QueryName|endswith: .torlink.co

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
QueryNameends_with
  • .hiddenservice.net corpus 2 (sigma 2)
  • .onion corpus 2 (sigma 2)
  • .onion.ca corpus 2 (sigma 2)
  • .onion.cab corpus 2 (sigma 2)
  • .onion.casa corpus 2 (sigma 2)
  • .onion.city corpus 2 (sigma 2)
  • .onion.direct corpus 2 (sigma 2)
  • .onion.dog corpus 2 (sigma 2)
  • .onion.glass corpus 2 (sigma 2)
  • .onion.gq corpus 2 (sigma 2)
  • .onion.guide
  • .onion.in.net
  • .onion.ink corpus 2 (sigma 2)
  • .onion.it corpus 2 (sigma 2)
  • .onion.link corpus 2 (sigma 2)
  • .onion.lt corpus 2 (sigma 2)
  • .onion.lu corpus 2 (sigma 2)
  • .onion.ly
  • .onion.mn
  • .onion.network
  • .onion.nu corpus 2 (sigma 2)
  • .onion.pet corpus 2 (sigma 2)
  • .onion.plus corpus 2 (sigma 2)
  • .onion.pt
  • .onion.pw
  • .onion.rip corpus 2 (sigma 2)
  • .onion.sh corpus 2 (sigma 2)
  • .onion.si
  • .onion.to corpus 2 (sigma 2)
  • .onion.top corpus 2 (sigma 2)
  • .onion.ws
  • .s1.tor-gateways.de corpus 2 (sigma 2)
  • .s2.tor-gateways.de corpus 2 (sigma 2)
  • .s3.tor-gateways.de corpus 2 (sigma 2)
  • .s4.tor-gateways.de corpus 2 (sigma 2)
  • .s5.tor-gateways.de corpus 2 (sigma 2)
  • .t2w.pw corpus 2 (sigma 2)
  • .tor2web.ae.org corpus 2 (sigma 2)
  • .tor2web.blutmagie.de corpus 2 (sigma 2)
  • .tor2web.com corpus 2 (sigma 2)
  • .tor2web.fi corpus 2 (sigma 2)
  • .tor2web.io corpus 2 (sigma 2)
  • .tor2web.org corpus 2 (sigma 2)
  • .tor2web.xyz corpus 2 (sigma 2)
  • .torlink.co corpus 2 (sigma 2)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.