Windows Process Execution of Tor or Tor Browser (tor.exe / Firefox-based)
Flags Windows execution of tor.exe or Tor Browser’s bundled Firefox from the expected installation path.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-20
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches Windows process creation events where the executable indicates Tor (tor.exe) or the Tor Browser (Tor Browser\Browser\firefox.exe). Attackers may use Tor to anonymize infrastructure and blend into normal network activity while communicating via onion routing. The detection relies on process creation telemetry, specifically the process image path/name fields and related metadata.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution of Tor or Tor Browser (tor.exe / Firefox-based)
id: fe63e32e-7c60-411e-8c28-8b4178641576
status: test
description: This rule matches Windows process creation events where the executable indicates Tor (tor.exe) or the Tor Browser (Tor Browser\Browser\firefox.exe). Attackers may use Tor to anonymize infrastructure and blend into normal network activity while communicating via onion routing. The detection relies on process creation telemetry, specifically the process image path/name fields and related metadata.
references:
- https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_tor_execution.yml
author: frack113, Huntrule Team
date: 2022-02-20
modified: 2025-10-27
tags:
- attack.command-and-control
- attack.t1090.003
logsource:
category: process_creation
product: windows
detection:
selection:
- Description: Tor Browser
- Product: Tor Browser
- Image|endswith:
- \tor.exe
- \Tor Browser\Browser\firefox.exe
condition: selection
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/info.yml
license: DRL-1.1
related:
- id: 62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c
type: derived