DNS events related to ToR proxies

Status: available
Severity: low
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

'Identifies IP addresses performing DNS lookups associated with common ToR proxies.'

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1048` Exfiltration Over Alternative Protocol

Rule body

id: a83ef0f4-dace-4767-bce3-ebd32599d2a0
name: DNS events related to ToR proxies
description: |
  'Identifies IP addresses performing DNS lookups associated with common ToR proxies.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: DNS
    dataTypes:
      - DnsEvents
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1048
query: |
  DnsEvents
  | where Name contains "."
  | where Name has_any ("tor2web.org", "tor2web.com", "torlink.co", "onion.to", "onion.ink", "onion.cab", "onion.nu", "onion.link",
  "onion.it", "onion.city", "onion.direct", "onion.top", "onion.casa", "onion.plus", "onion.rip", "onion.dog", "tor2web.fi",
  "tor2web.blutmagie.de", "onion.sh", "onion.lu", "onion.pet", "t2w.pw", "tor2web.ae.org", "tor2web.io", "tor2web.xyz", "onion.lt",
  "s1.tor-gateways.de", "s2.tor-gateways.de", "s3.tor-gateways.de", "s4.tor-gateways.de", "s5.tor-gateways.de", "hiddenservice.net")
  | extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)
  | extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"")
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIP
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

DnsEvents

Stage 2: `where`

| where Name contains "."

Stage 3: `where`

| where Name has_any ("tor2web.org", "tor2web.com", "torlink.co", "onion.to", "onion.ink", "onion.cab", "onion.nu", "onion.link",
"onion.it", "onion.city", "onion.direct", "onion.top", "onion.casa", "onion.plus", "onion.rip", "onion.dog", "tor2web.fi",
"tor2web.blutmagie.de", "onion.sh", "onion.lu", "onion.pet", "t2w.pw", "tor2web.ae.org", "tor2web.io", "tor2web.xyz", "onion.lt",
"s1.tor-gateways.de", "s2.tor-gateways.de", "s3.tor-gateways.de", "s4.tor-gateways.de", "s5.tor-gateways.de", "hiddenservice.net")

Stage 4: `extend`

| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)

HostName =

ifComputer has "."substring(Computer, 0, indexof(Computer, '.'))

elseComputer

Stage 5: `extend`

| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"")

DnsDomain =

ifComputer has "."substring(Computer, (indexof(Computer, '.') + 1))

else""

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Name`	contains	`.`	`field:"Name" kind:contains value:"."`
`Name`	match	`hiddenservice.net` transforms: `term` `onion.cab` transforms: `term` `onion.casa` transforms: `term` `onion.city` transforms: `term` `onion.direct` transforms: `term` `onion.dog` transforms: `term` `onion.ink` transforms: `term` `onion.it` transforms: `term` `onion.link` transforms: `term` `onion.lt` transforms: `term` `onion.lu` transforms: `term` `onion.nu` transforms: `term` `onion.pet` transforms: `term` `onion.plus` transforms: `term` `onion.rip` transforms: `term` `onion.sh` transforms: `term` `onion.to` transforms: `term` `onion.top` transforms: `term` `s1.tor-gateways.de` transforms: `term` `s2.tor-gateways.de` transforms: `term` `s3.tor-gateways.de` transforms: `term` `s4.tor-gateways.de` transforms: `term` `s5.tor-gateways.de` transforms: `term` `t2w.pw` transforms: `term` `tor2web.ae.org` transforms: `term` `tor2web.blutmagie.de` transforms: `term` `tor2web.com` transforms: `term` `tor2web.fi` transforms: `term` `tor2web.io` transforms: `term` `tor2web.org` transforms: `term` `tor2web.xyz` transforms: `term` `torlink.co` transforms: `term`	`field:"Name" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`HostName`	`extend`
`DnsDomain`	`extend`

DNS events related to ToR proxies

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend