Torsocks Execution

[rule]
description = """
This rule detects the execution of the "torsocks" binary, which is commonly used to route network traffic through the
Tor network. Attackers may use "torsocks" to anonymize their network connections, making it harder to trace their
activities. This tool is uncommonly used in a business context, and its presence may indicate an attempt to evade
detection or exfiltrate data through the Tor network.
"""
id = "3beb08ba-79ab-4d16-b33a-25479551967e"
license = "Elastic License v2"
name = "Torsocks Execution"
os_list = ["linux"]
reference = ["https://www.trendmicro.com/en_us/research/25/f/tor-enabled-docker-exploit.html"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "torsocks"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"