Query: alert when Detects DNS queries to an ".onion" address related to Tor routing networks
Matching passage: Sigma rule: Detects DNS queries to an ".onion" address related to Tor routing networks. Logsource: windows / dns_query. Rule: title: DNS Query Tor .Onion Address - Sysmon id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544 related: - id: 8384bd26-bde6-4da9-8e5d-4174a7a47ca2 type: similar - id: a8322756-015c-42e7-afb1-436e85ed3ff5 type: similar status: test description: Detects DNS queries to an ".onion" address related to Tor routing networks references: - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/ - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml author: frack113 date: 2022-02-20 modified: 2025-09-12 tags: - attack.command-and-control - attack.t1090.003 logsource: product: windows category: dns_query detection: selection: QueryName|endswith: - .hiddenservice.net - .onion.ca - .onion.cab - .onion.casa - .onion.city - .onion.direct - .onion.dog - .onion.glass - .onion.gq - .onion.ink - .onion.it - .onion.link - .onion.lt - .onion.lu - .onion.nu - .onion.pet - .onion.plus - .onion.rip - .onion.sh - .onion.to - .onion.top - .onion - .s1.tor-gateways.de - .s2.tor-gateways.de - .s3.tor-gateways.de - .s4.tor-gateways.de - .s5.tor-gateways.de - .t2w.pw - .tor2web.ae.org - .tor2web.blutmagie.de - .tor2web.com - .tor2web.fi - .tor2web.io - .tor2web.org - .tor2web.xyz - .torlink.co condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious process patterns used in NTDS.DIT exfiltration. Logsource: windows / process_creation. Rule: title: Suspicious Process Patterns NTDS.DIT Exfil id: 8bc64091-6875-4881-aaf9-7bd25b5dda08 status: test description: Detects suspicious process patterns used in NTDS.DIT exfiltration references: - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://pentestlab.blog/tag/ntds-dit/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1 - https://github.com/zcgonvh/NTDSDumpEx - https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1 - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2022-11-10 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: process_creation detection: selection_tool: - Image|endswith: - \NTDSDump.exe - \NTDSDumpEx.exe - CommandLine|contains|all: - ntds.dit - system.hiv - CommandLine|contains: NTDSgrab.ps1 selection_oneliner_1: CommandLine|contains|all: - ac i ntds - create full selection_onliner_2: CommandLine|contains|all: - '/c copy ' - \windows\ntds\ntds.dit selection_onliner_3: CommandLine|contains|all: - activate instance ntds - create full selection_powershell: CommandLine|contains|all: - powershell - ntds.dit set1_selection_ntds_dit: CommandLine|contains: ntds.dit set1_selection_image_folder: - ParentImage|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ - Image|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: 1 of selection* or all of set1* falsepositives: - Unknown level: high