Windows Tor or Tor Browser Process Execution via Tor and Tor Browser Binaries

title: Windows Tor or Tor Browser Process Execution via Tor and Tor Browser Binaries
id: fe63e32e-7c60-411e-8c28-8b4178641576
status: test
description: This rule matches process creation events where the executable appears to be Tor (tor.exe) or Tor Browser (firefox.exe located under the Tor Browser directory). Attackers can use Tor or Tor Browser to obscure network origin and access services over onion routing. Telemetry required is Windows process creation data including product/description fields and the executable image path.
references:
  - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_tor_execution.yml
author: frack113, Huntrule Team
date: 2022-02-20
modified: 2025-10-27
tags:
  - attack.command-and-control
  - attack.t1090.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: Tor Browser
    - Product: Tor Browser
    - Image|endswith:
        - \tor.exe
        - \Tor Browser\Browser\firefox.exe
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/info.yml
license: DRL-1.1
related:
  - id: 62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c
    type: derived