IC Tor Exit Browser Hunting Based On Device Events
Query
//Author Sergio Albea 18-11-2025
let TorExitNodesHistoric = externaldata(IP:string, ActiveDates:string, Source:string) ['https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit-historic.json.zip'] with(format="multijson");
TorExitNodesHistoric
| extend ActiveDates = split(ActiveDates, ',')
| extend Country = tostring(geo_info_from_ip_address(IP)['country'])
| summarize ActiveDays = array_length(make_set(ActiveDates)) by Country,IP,Source
| join kind=inner (DeviceNetworkEvents) on $left.IP == $right.RemoteIP
| summarize by Source,DeviceName,TOR_Exit_Node= LocalIP,Country,ActiveDays,RemoteUrl, InitiatingProcessAccountName, InitiatingProcessVersionInfoProductName, ActionType//, Timestamp,ReportId
| order by ActiveDaysAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1090.003 | Proxy: Multi-hop Proxy |
Author: Sergio Albea (18/11/2025)
[IC] -Tor Exit Browser hunting based on Device Events
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1090.003 | Multi-hop Proxy |
| Author | Sergio Albea (30/10/2025) |
|---|
Description: A Tor exit node is the last server in the Tor network that your traffic passes through before it reaches the public internet so it is the one that actually makes the connection to website. In this particular query, I am getting the devices with connections to Tor Exit Nodes, to list to which node are connecting and possible suspicious URLs with connections to the mentioned servers.
Explanation
This query is designed to identify devices that are connecting to Tor exit nodes, which are the final nodes in the Tor network before traffic reaches the public internet. The goal is to detect potentially suspicious activity by listing the devices, the specific Tor exit nodes they are connecting to, and any suspicious URLs associated with these connections.
Here's a simplified breakdown of the query:
-
Data Source: The query uses a dataset of historical Tor exit nodes, which includes information about the IP addresses of these nodes, the dates they were active, and their source.
-
Data Processing:
- The query extracts and processes the active dates for each Tor exit node.
- It determines the country associated with each IP address.
- It calculates the number of days each Tor exit node was active.
-
Joining with Device Events:
- The query joins this Tor exit node data with device network events, specifically looking for matches where a device's remote IP matches a Tor exit node's IP.
-
Summarizing Results:
- It summarizes the data to show which devices (by name) are connecting to Tor exit nodes, the specific Tor exit node IPs, the country of the exit node, the number of active days, and any remote URLs involved.
- Additional details like the account name initiating the process and the product name of the initiating process are also included.
-
Output:
- The results are ordered by the number of active days, potentially highlighting more frequently used Tor exit nodes.
Overall, this query helps in monitoring and identifying devices within a network that are using Tor, which could indicate attempts to anonymize internet activity, possibly for malicious purposes.
