huntrule

Windows Process Execution of Tor or Tor Browser (tor.exe / Firefox-based)

Flags Windows execution of tor.exe or Tor Browser’s bundled Firefox from the expected installation path.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-02-20
Updated
2026-07-31
AnalysisDetection
title: Windows Process Execution of Tor or Tor Browser (tor.exe / Firefox-based)
id: fe63e32e-7c60-411e-8c28-8b4178641576
status: test
description: This rule matches Windows process creation events where the executable indicates Tor (tor.exe) or the Tor Browser (Tor Browser\Browser\firefox.exe). Attackers may use Tor to anonymize infrastructure and blend into normal network activity while communicating via onion routing. The detection relies on process creation telemetry, specifically the process image path/name fields and related metadata.
references:
  - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_tor_execution.yml
author: frack113, Huntrule Team
date: 2022-02-20
modified: 2025-10-27
tags:
  - attack.command-and-control
  - attack.t1090.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: Tor Browser
    - Product: Tor Browser
    - Image|endswith:
        - \tor.exe
        - \Tor Browser\Browser\firefox.exe
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/info.yml
license: DRL-1.1
related:
  - id: 62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c
    type: derived