title: Query Tor Onion Address
id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544
status: experimental
description: Detects DNS resolution of an .onion address related to Tor routing networks
references:
    - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
author: frack113
date: 2022/02/20
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        QueryName|contains: '.onion'
    condition: selection
falsepositives:
    - Unknown
level: high
tags:
    - attack.command_and_control
    - attack.t1090.003
