huntrule

Windows Sysmon DNS Query to .onion or Tor Gateway Domains

Alerts when Windows Sysmon DNS queries target .onion or Tor gateway/proxy-related domain suffixes.

FreeReviewedSigma · High · v2
Product
windows
Category
dns_query
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-02-20
Updated
2026-07-31
AnalysisDetection
title: Windows Sysmon DNS Query to .onion or Tor Gateway Domains
id: 251185c0-8dc7-4f56-b3e7-3bb452345a13
related:
  - id: 8384bd26-bde6-4da9-8e5d-4174a7a47ca2
    type: similar
  - id: a8322756-015c-42e7-afb1-436e85ed3ff5
    type: similar
  - id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544
    type: derived
status: test
description: This rule flags DNS queries where the queried name ends with .onion, .hiddenservice.net, .onion.* TLDs, Tor gateway subdomains (s1–s5.tor-gateways.de), or tor2web/torlink domains. Attackers may use these domains to reach Tor-hidden services or related routing/proxy infrastructure, making DNS lookups a valuable early signal for command-and-control and evasion. It relies on Windows Sysmon DNS query telemetry, specifically the QueryName field ending with the listed patterns.
references:
  - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
  - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_tor_onion_domain_query.yml
author: frack113, Huntrule Team
date: 2022-02-20
modified: 2025-09-12
tags:
  - attack.command-and-control
  - attack.t1090.003
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|endswith:
      - .hiddenservice.net
      - .onion.ca
      - .onion.cab
      - .onion.casa
      - .onion.city
      - .onion.direct
      - .onion.dog
      - .onion.glass
      - .onion.gq
      - .onion.ink
      - .onion.it
      - .onion.link
      - .onion.lt
      - .onion.lu
      - .onion.nu
      - .onion.pet
      - .onion.plus
      - .onion.rip
      - .onion.sh
      - .onion.to
      - .onion.top
      - .onion
      - .s1.tor-gateways.de
      - .s2.tor-gateways.de
      - .s3.tor-gateways.de
      - .s4.tor-gateways.de
      - .s5.tor-gateways.de
      - .t2w.pw
      - .tor2web.ae.org
      - .tor2web.blutmagie.de
      - .tor2web.com
      - .tor2web.fi
      - .tor2web.io
      - .tor2web.org
      - .tor2web.xyz
      - .torlink.co
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1